I have a web page with some javascript inside that will be embedded as iframe in different websites. I need to adjust the behaviour of my page according to the website in which it's being run. For this purpose, I tried to read top.location.href from my page, but that raised an error:

Unsafe JavaScript attempt to access frame with URL from frame with URL . Domains, protocols and ports must match.

Is there some way to go around this?

I have a web page with some javascript inside that will be embedded as iframe in different websites. I need to adjust the behaviour of my page according to the website in which it's being run. For this purpose, I tried to read top.location.href from my page, but that raised an error:

Unsafe JavaScript attempt to access frame with URL http://website.url from frame with URL http://mypage.url. Domains, protocols and ports must match.

Is there some way to go around this?

• javascript
• same-origin-policy

Share Improve this question Follow asked Dec 23, 2011 at 17:32 etuarduetuardu 5,57633 gold badges5252 silver badges6363 bronze badges 2

• No, that's not possible for arbitrary websites. – Rob W Commented Dec 23, 2011 at 17:34
• I've provided an answer below and in the duplicate question stackoverflow./questions/4903351/… – mcanfield Commented Oct 17, 2013 at 22:34

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 12

In the most mon case you can indeed retrieve the parent url of the iframe. If the iframe is just one level deep this method will work:

var parentURL = document.referrer

https://developer.mozilla/en-US/docs/Web/API/document.referrer

I've used this method when creating iframe widgets. Just remember that if you want the top level window location, but it is not the parent window of your iframe...you won't be able to get it. Also, if your widget navigates within the iframe the referrer will then change.

Yet another excellent write-up by Nicholas Zakas can be found on his blog here: http://www.nczonline/blog/2013/04/16/getting-the-url-of-an-iframes-parent/

This is as you stated the same origin policy and it is in place for security reasons. Without changing the users browser there is no way around it.