Security Error with iframe

Question

The following issue occurs in Android 4.4 devices and above.

This is what our iframe looks like:

<iframe frameborder=0 id="myIFRAME"></iframe>

The following is the way we are getting iframe programmatically:

if(document.getElementById("myIFRAME")){
        me.setMyIFRAME(document.getElementById("myIFRAME").contentWindow);
}

This is causing a security error related to Protocol mismatch:

"Uncaught SecurityError: Blocked a frame with origin "https://www.google.com" from accessing a frame with origin "file://". The frame requesting access has a protocol of "https", the frame being accessed has a protocol of "file". Protocols must match.

We are using Sencha touch with Cordova to develop our project.

score 4 · Answer 1 · answered Sep 16 '15 at 18:36

The Cordova security guide says:

If content is served in an iframe from a whitelisted domain, that domain will have access to the native Cordova bridge.

Have you tried adding the external domain to the whitelist inside config.xml?

<access origin="https://google.com" />

score 0 · Answer 2 · answered Sep 21 '15 at 06:54

0

@Ritika,
I'm taking a wild guess here, because I do not use iframes, but in your <iframe> element I do NOT see a src. As such, the system is setting it to some type of default and the protocol of that source is file://

I think if you set a src=, even a blank one, the issue will go away.

Away, just a guess. Best of Luck.

answered Sep 21 '15 at 06:54

src is dynamically created in code & then is ultimately set on iframe.Even i tried to set src = '' initially, but that doesnt helped – Ritika Oct 01 '15 at 10:45
Okay, Shot in the dark. Are you using the *white-list*, the plugin and CSP? – Oct 01 '15 at 19:17
I have tried using whie-listing , that too doesnt help – Ritika Oct 06 '15 at 07:11
Okay. A few more issues to try. Are you using an alternate webview library? Like crosswalk? You did not say if you are using CSP? Which version of the Cordova/phonegap compiler are you using? Which version of the plugin are you using? Have you tried the *minSDK* and *targetSDK*? – Oct 06 '15 at 21:57

score 0 · Answer 3 · answered Sep 21 '15 at 13:15

0

Google is not accessible over iFrame.
From a page served using file:// protocol cannot access resources over http:// or https:// protocol by default.

answered Sep 21 '15 at 13:15

Ashok Vishwakarma

669
7
20

score 0 · Answer 4 · answered Sep 21 '15 at 15:54

0

Personaly, I would avoid using iFrames all together.

https://github.com/phonegap/phonegap/wiki/iFrame-Usage

answered Sep 21 '15 at 15:54

johnborges

2,422
20
33

score 0 · Accepted Answer · answered Nov 09 '15 at 10:13

0

It turned out that iframe was loading html page which was accessing window.document which was causing Cross-domain security error Below if condition was inside page

 if (window.parent.document != window.document)

we change it to below condition which resolve security error

if (window.parent != window)

answered Nov 09 '15 at 10:13

Ritika

593
1
8
21

Where i have to use this – Vishnu Feb 15 '18 at 07:14

Security Error with iframe

5 Answers5