1

Can someone explain why awesome tools like JS Bin give errors like: 

Runner: Permission denied to access property 'scrollX'

when I'm trying code like: 

<button onClick="exit();">Exit</button>

<script>    
function exit() { 
    window.location = 'http://www.youtube.com/';
}
</script>

...that work fine if they are called from a regular file in the browser?

Thanks.

Edit: Correction Firefox gives the error.

Leke
  • 873
  • 3
  • 15
  • 28
  • 1
    It's probably got something to do with the fact that you are trying to load an external site inside JSBin's iFrame. `Load denied by X-Frame-Options: http://www.youtube.com/ does not permit cross-origin framing.` – gen_Eric Jul 05 '13 at 19:57

1 Answers1

6

It's because the iframe that the runner (the thing that automatically generates the preview in jsbin) has sandbox'ed properties on it.

It's been set up so that the only thing that the iframe can't do is set the location of the window. This stops someone from sending a malicious bin to another user, and then suddenly redirectly elsewhere.

Similarly, sites like youtube.com prevent their content from being set in an iframe, and such you see a blank window, like this: http://responsivepx.com/?youtube.com (note that the blank window is where youtube.com is supposed to be).

I'm the primary dev on jsbin by the way, which is why I know :)

Remy Sharp
  • 4,520
  • 3
  • 23
  • 40
  • Remy , is it possible to create on jsbin#1 an iframe which its src is jsbin#2 , and to be able to access the windows object of the #2 from #1 ? what if i want to test SOP ? it currently disallows me ( and i know why) I ask if its possible. – Royi Namir Nov 25 '13 at 12:30