Nerd-puzzle: how might I allow sibling same-origin iframes to communicate, given…
- parent is cross-origin
- can’t execute JS on parent
- no sessionStorage, localStorage, cookies, or IDB access
- with enough security to share auth tokens?
Conversation
Nope, alas: can’t access window.parent.frames cross-origin.
1
(to my surprise, Firefox allows this! but Chrome and Safari sensibly don’t)
2
window.parent[x] should work the same as window.parent.frames[x] (in general someWin.frames === someWin). And at least per spec should be allowed cross-origin.
1
No dice! I’m awfully surprised this is meant to be allowed. Why should it be?
Hmm. In general you're supposed to be able to access the frame tree; you just get a censored view of the Window object (containing only the properties in html.spec.whatwg.org/multipage/brow, such as postMessage).
1
Ah, I see. Yes, I was hoping for postMessage access, but I was unsurprised to meet a brick wall instead. :)