Nerd-puzzle: how might I allow sibling same-origin iframes to communicate, given…
- parent is cross-origin
- can’t execute JS on parent
- no sessionStorage, localStorage, cookies, or IDB access
- with enough security to share auth tokens?
Conversation
Nope, alas: can’t access window.parent.frames cross-origin.
1
(to my surprise, Firefox allows this! but Chrome and Safari sensibly don’t)
Replying to
Okay, I've seen one more weird trick, but it involves more coordination: triply embedded iframes
- origin 1
- origin 2
- origin 1
These sometimes offer possibilities for communicating, but you need help from origin 1
2
Won’t be able to ask for help from the parent origin, alas.
1
Show replies
window.parent[x] should work the same as window.parent.frames[x] (in general someWin.frames === someWin). And at least per spec should be allowed cross-origin.
1
No dice! I’m awfully surprised this is meant to be allowed. Why should it be?
1
1
Show replies