Blocked a frame with origin "https://xyz.com" from accessing a cross-origin frame

Question

User86716463 posted

Dear All,

I have a site called https://abc.com  Where I have used iframe init and try load another website (https://xyz.com) in the iframe. When I do that , I am gettimg below error message

Blocked a frame with origin "https://xyz.com" from accessing a cross-origin frame

Please help me on this

Thanks in Advance!!

Regards.
Ramesh

Answer 1

User753101303 posted

Hi,

Do you own both sites? I would say that xyz tries to manipulate abc which would be a security issue. According to https://www.w3schools.com/tags/att_iframe_sandbox.asp it seems that using sandbox="allow-same-origin" could allow to remove this restriction ?

Answer 2

User-1038772411 posted

Hello n.m.rameshraja,

If you are using javascript You can't access an <iframe> with Javascript, it would be a huge security flaw if you could do it. For the same-origin policy browsers block scripts trying to access a frame with a different origin.

For more information. You could refer to the following link:

http://stackoverflow.com/questions/25098021/securityerror-blocked-a-frame-with-origin-from-accessing-a-cross-origin-frame

https://community.microstrategy.com/t5/Web/TN275329-quot-Blocked-a-frame-with-origin-WEBSERVER-from/ta-p/275329

Thank you.

</div>

Answer 3

User86716463 posted

Hi ,

Yes, I own both sites. I need to call another site(xyz.com) from iframe of first site(abc.com). 

Answer 4

User71929859 posted

Yes, I own both sites. I need to call another site(xyz.com) from iframe of first site(abc.com). 

Then you can set the X-Frame-Options in your xyz.com site.

Go to the web.config in your xyz.com web application and add the below

<httpProtocol>
    <customHeaders>
      <add name="X-Frame-Options" value="allow-from http://abc.com" />
    </customHeaders>
</httpProtocol>

Insert the above code in between <system.webServer> tags.