"Access is denied" JavaScript error when trying to access the document object of a programmatically-created <iframe> (IE-only)

Asked 11/12, 2009 at 8:7 Answered 10/9, 2021 at 1:20

Solved javascript internet-explorer dom iframe document

I have project in which I need to create an <iframe> element using JavaScript and append it to the DOM. After that, I need to insert some content into the <iframe>. It's a widget that will be embedded in third-party websites.

I don't set the "src" attribute of the <iframe> since I don't want to load a page; rather, it is used to isolate/sandbox the content that I insert into it so that I don't run into CSS or JavaScript conflicts with the parent page. I'm using JSONP to load some HTML content from a server and insert it in this <iframe>.

I have this working fine, with one serious exception - if the document.domain property is set in the parent page (which it may be in certain environments in which this widget is deployed), Internet Explorer (probably all versions, but I've confirmed in 6, 7, and 8) gives me an "Access is denied" error when I try to access the document object of this <iframe> I've created. It doesn't happen in any other browsers I've tested in (all major modern ones).

This makes some sense, since I'm aware that Internet Explorer requires you to set the document.domain of all windows/frames that will communicate with each other to the same value. However, I'm not aware of any way to set this value on a document that I can't access.

Is anyone aware of a way to do this - somehow set the document.domain property of this dynamically created <iframe>? Or am I not looking at it from the right angle - is there another way to achieve what I'm going for without running into this problem? I do need to use an <iframe> in any case, as the isolated/sandboxed window is crucial to the functionality of this widget.

Here's my test code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
    <title>Document.domain Test</title>
    <script type="text/javascript">
      document.domain = 'onespot.com'; // set the page's document.domain
    </script>
  </head>
  <body>
    <p>This is a paragraph above the &lt;iframe&gt;.</p>
    <div id="placeholder"></div>
    <p>This is a paragraph below the &lt;iframe&gt;.</p>
    <script type="text/javascript">
      var iframe = document.createElement('iframe'), doc; // create <iframe> element
      document.getElementById('placeholder').appendChild(iframe); // append <iframe> element to the placeholder element
      setTimeout(function() { // set a timeout to give browsers a chance to recognize the <iframe>
        doc = iframe.contentWindow || iframe.contentDocument; // get a handle on the <iframe> document
        alert(doc);
        if (doc.document) { // HEREIN LIES THE PROBLEM
          doc = doc.document;
        }
        doc.body.innerHTML = '<h1>Hello!</h1>'; // add an element
      }, 10);
    </script>
  </body>
</html>

I've hosted it at:

http://troy.onespot.com/static/access_denied.html

As you'll see if you load this page in IE, at the point that I call alert(), I do have a handle on the window object of the <iframe>; I just can't get any deeper, into its document object.

Thanks very much for any help or suggestions! I'll be indebted to whomever can help me find a solution to this.

Sibyls answered 11/12, 2009 at 8:7 Comment(1)

The link for troy.onespot is dead. – Trochaic 25/7, 2018 at 20:9

if the document.domain property is set in the parent page, Internet Explorer gives me an "Access is denied"

Sigh. Yeah, it's an IE issue (bug? difficult to say as there is no documented standard for this kind of unpleasantness). When you create a srcless iframe it receives a document.domain from the parent document's location.host instead of its document.domain. At that point you've pretty much lost as you can't change it.

A horrendous workaround is to set src to a javascript: URL (urgh!):

 iframe.src= "javascript:'<html><body><p>Hello<\/p><script>do things;<\/script>'";

But for some reason, such a document is unable to set its own document.domain from script in IE (good old “unspecified error”), so you can't use that to regain a bridge between the parent(*). You could use it to write the whole document HTML, assuming the widget doesn't need to talk to its parent document once it's instantiated.

However iframe JavaScript URLs don't work in Safari, so you'd still need some kind of browser-sniffing to choose which method to use.

*: For some other reason, you can, in IE, set document.domain from a second document, document.written by the first document. So this works:

if (isIE)
    iframe.src= "javascript:'<script>window.onload=function(){document.write(\\'<script>document.domain=\\\""+document.domain+"\\\";<\\\\/script>\\');document.close();};<\/script>'";

At this point the hideousness level is too high for me, I'm out. I'd do the external HTML like David said.

Cobalt answered 11/12, 2009 at 15:15 Comment(7)

@bobince: You're awesome! I actually did stumble upon this very approach late last night after a lot more Googling. In fact, I think I might have found an even more robust, and potentially less kludgy cross-browser solution: telerik.com/community/forums/aspnet-ajax/editor/… - notice Jeff Tucker's post from August 21. Setting the <iframe>'s "src" attribute to "javascript:void((function(){document.open();document.domain=\'tld.com\';document.close();})())" seems to do the trick, and in a cross-browser way. It also works in Safari (at least v3+). – Sibyls 11/12, 2009 at 18:29

Here's a test page illustrating my previous comment: troy.onespot.com/static/access_denied_test.html – Sibyls 11/12, 2009 at 18:29

Oh great! That's much better! Interesting that doing it directly should work... normally, a javascript: URL would be executed in the context of its parent, but that seems not to be the case with iframe src. You can probably also lose the void() call, since the function already returns undefined. – Cobalt 11/12, 2009 at 19:3

Incidentally you get an error reloading the page in IE with this, as IE tries to retain the iframe location... argh. Dunno if there's a way around that. – Cobalt 11/12, 2009 at 19:5

@bobince: Oh man, you're right. Thanks for pointing that out; I was so excited that it worked the first time that I didn't bother to reload. What do you mean by IE trying to retain the <iframe> location? I've got to find a solution to this so I'll keep you posted - please do the same if you happen to find anything. – Sibyls 12/12, 2009 at 4:37

@Cobalt - any improvement to this? see question here: #14879692 – Ellie 24/2, 2013 at 21:10

A solution may be to insert a different ID in the iframe's src attribute everytime you load the frame, for example new Date().getTime(). Horrible but that seems to work. – Housecarl 14/5, 2015 at 14:14

Well yes, the access exception is due to the fact that document.domain must match in your parent and your iframe, and before they do, you won't be able to programmatically set the document.domain property of your iframe.

I think your best option here is to point the page to a template of your own:

iframe.src = '/myiframe.htm#' + document.domain;

And in myiframe.htm:

document.domain = location.hash.substring(1);

Personable answered 11/12, 2009 at 8:18 Comment(3)

Thanks, David - I appreciate what appears to be a solid suggestion, but I'd rather not take this approach unless it's a last resort. If I understand correctly, the template would need to live on the same domain as the parent page (is that right?), and that would complicate implementation for our customers. Ideally the implementation should be as simple as inserting a few lines of JavaScript in their pages' HTML. – Sibyls 11/12, 2009 at 8:34

Yes, the solution does require another file on that very domain. I'm afraid that's the best I can come up with, though. – Personable 11/12, 2009 at 8:43

@Bungle: I think it's your only option. – Karoline 11/12, 2009 at 9:15

well i actually have a very similar problem, but with a twist... say the top level site is a.foo.com - now i set document domain to a.foo.com

then in the iframe that i create / own,i also set it too a.foo.com

note that i cant set them too foo.com b/c there is another iframe in the page pointed to b.a.foo.com (which again uses a.foo.com but i cant change the script code there)

youll note that im essentially setting document.domain to what it already would be anyway...but i have to do that to access the other iframe i mentioned from b.a.foo.com

inside my frame, after i set the domain, eventhough all iframes have the same setting, i still get an error when reaching up into the parent in IE 6/7

there are other things that r really bizaree

in the outside / top level, if i wait for its onload event, and set a timer, eventually i can reach down into the frame i need to access....but i can never reach from bottom up... and i really need to be able to

also if i set everything to be foo.com (which as i said i cannot do) IT WORKS! but for some reason, when using the same value as location.host....it doesnt and its freaking killing me.....

Captivate answered 23/10, 2012 at 8:40 Comment(0)

I just use <iframe src="about:blank" ...></iframe> and it works fine.

Adriell answered 19/4, 2013 at 19:8 Comment(0)

for IE, the port matters. In between domains, it should be same port.

Whine answered 27/11, 2014 at 6:38 Comment(0)

Have you tried jQuery.contents() ?

Ithnan answered 11/12, 2009 at 8:14 Comment(5)

Deniss, good suggestion, and thank you - I gave this a shot (see <troy.onespot.com/static/access_denied_jquery.html>) but got a similar error; this time it's "Permission denied" within the jQuery script. I suspect it's the same or a similar roadblock. – Sibyls 11/12, 2009 at 8:38

Sorry, that URL got mangled. Try: troy.onespot.com/static/access_denied_jquery.html – Sibyls 11/12, 2009 at 8:39

Why would jQuery have magical access to the iframe's document? – Karoline 11/12, 2009 at 9:17

@Tim Down: I don't think the assumption was that jQuery would have magical access; rather, jQuery often has some nifty tricks up its sleeve to solve cross-browser issues, and might have already implemented a workaround. I agree it didn't bode well, but I think it was a good suggestions and worth a shot. – Sibyls 11/12, 2009 at 10:14

This really isn't an answer. It's only a suggestion and would probably be better as a comment on the original post. – Phenylamine 8/9, 2016 at 19:19

It seems that the problem with IE comes when you try and access the iframe via the document.frames object - if you store a reference to the created iframe in a variable then you can access the injected iframe via the variable (my_iframe in the code below).

I've gotten this to work in IE6/7/8

var my_iframe;
var iframeId = "my_iframe_name"
if (navigator.userAgent.indexOf('MSIE') !== -1) {
  // IE wants the name attribute of the iframe set
  my_iframe = document.createElement('<iframe name="' + iframeId + '">');
} else {
  my_iframe = document.createElement('iframe');
}

iframe.setAttribute("src", "javascript:void(0);");
iframe.setAttribute("scrolling", "no");
iframe.setAttribute("frameBorder", "0");
iframe.setAttribute("name", iframeId);

var is = iframe.style;
is.border = is.width = is.height = "0px";

if (document.body) {
  document.body.appendChild(my_iframe);
} else {
  document.appendChild(my_iframe);
}

Adjective answered 22/3, 2010 at 20:19 Comment(2)

Thanks. This seems to have fixed the problem for me. – Bebop 9/7, 2011 at 22:50

weird thing is, this was the same thing I was using. was working fine, now all of a sudden, I keep getttig access denied errors – Legion 1/12, 2013 at 1:30

I had a similar issue and my solution was this code snippet (tested in IE8/9, Chrome and Firefox)

var iframe = document.createElement('iframe');
document.body.appendChild(iframe);

iframe.src = 'javascript:void((function(){var script = document.createElement(\'script\');' +
  'script.innerHTML = "(function() {' +
  'document.open();document.domain=\'' + document.domain +
  '\';document.close();})();";' +
  'document.write("<head>" + script.outerHTML + "</head><body></body>");})())';

iframe.contentWindow.document.write('<div>foo</div>');

I've tried several methods but this one appeared to be the best. You can find some explanations in my blog post here.

Edelman answered 20/6, 2015 at 11:38 Comment(0)

Following the exceedingly simple method from Andralor here fixed the issue for me: https://github.com/fancyapps/fancyBox/issues/766

Essentially, call the iframe again onUpdate:

$('a.js-fancybox-iframe').fancybox({
    type: 'iframe',
    scrolling : 'visible',
    autoHeight: true,
    onUpdate: function(){
     $("iframe.fancybox-iframe");
   }
 });

Fransiscafransisco answered 7/10, 2015 at 22:29 Comment(0)

Setting the document.domain property in the parent page isn't enough. Both the parent and child must use the same https/http protocol. Also, the port must be the same (as mentioned here in another answer).

So, for example if you navigate to

http://subdomain1.yoursite.com/parent.htm

and the child iframe is loaded from

httpS://subdomain2.yoursite.com/child.htm

then access will be denied from child to parent.

Suboceanic answered 10/9, 2021 at 1:20 Comment(0)

-2

IE works with iframe like all the other browsers (at least for main functions). You just have to keep a set of rules:

before you load any javascript in the iframe (that part of js which needs to know about the iframe parent), ensure that the parent has document.domain changed.
when all iframe resources are loaded, change document.domain to be the same as the one defined in parent. (You need to do this later because setting domain will cause the iframe resource's request to fail)
now you can make a reference for parent window: var winn = window.parent
now you can make a reference to parent HTML, in order to manipulate it: var parentContent = $('html', winn.document)
at this point you should have access to IE parent window/document and you can change it as you wont

Anglicist answered 21/2, 2016 at 16:59 Comment(0)

-10

For me I found the better answer was to check the file permissons that access is being denied to.

I just update to jQuery-1.8.0.js and was getting the Access Denied error in IE9.

From Windows Explorer

I right clicked on the file selected the Properties
Selected the Security Tab
Clicked the Advanced Button
Selected the Owner Tab
Clicked on Edit Button
Selected Administrators(MachineName\Administrators)
Clicked Apply
Closed all the windows.

Tested the site. No more issue.

I had to do the same for the the jQuery-UI script I had just updated as well

Riddance answered 19/8, 2012 at 14:24 Comment(2)

I think you're solving a different problem. – Galcha 22/10, 2012 at 13:28

The OP is building a third party widget. You cannot expect every visitor to follow all these steps to get the widget displayed. – Bellda 20/12, 2012 at 0:37

Hot tags

Godot Unity Godot Help Programming Godot 4.X GUI GDScript 3D 2D Physics CSharp Godot 3.X VR XR Projects C++

Recommended topics

Hot tags