Cross-Frame Scripting, IFRAME and https (access denied)

[Cindy Lee]

I'm trying to dynamically set the height of my Iframe. my https: main page
is calling another https in an Iframe. But i get an access denied error
from my javascript trying to call the parent document.

Main https page
<IFRAME APPLICATION="ye s" style="width:10 0%;" id="iframename "
frameborder="no " scrolling="no" SRC="https://www.otherdomain .com">



otherdomain.com html
------------------------------------------------
<script>
function bodyheight() {
x = document.body.s crollHeight
parent.document .all.iframename .style.height = x
}
</script>

[Randy Webb]

Re: Cross-Frame Scripting, IFRAME and https (access denied)

Cindy Lee wrote:[color=blue]
> I'm trying to dynamically set the height of my Iframe. my https: main page
> is calling another https in an Iframe. But i get an access denied error
> from my javascript trying to call the parent document.
>
> Main https page
> <IFRAME APPLICATION="ye s" style="width:10 0%;" id="iframename "
> frameborder="no " scrolling="no" SRC="https://www.otherdomain .com">[/color]

And there, in your SRC attribute, is the source of your problems. You
are trying to script one domain from another and that is a *very*
serious breach of security. It doesn't matter that they both belong to
you, the browser doesn't care. They aren't the same domain.
[color=blue]
> otherdomain.com html
> ------------------------------------------------
> <script>
> function bodyheight() {
> x = document.body.s crollHeight
> parent.document .all.iframename .style.height = x[/color]

Further, that line will only work in IE and a very small list of other
browsers since its the only ones that support document.all

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/