Check an iFrame is being hosted by an allowed domain
c#, html, http, javascript
Solution
However, is there anyway to know the top level domain of the site hosting the iframe?
Nothing reliable.
Presumably this is not sent in the http request for the iFrame? Or is it, I couldn’t see it?
It might be sent in the referer
Or do you need to send the domain from javascript?
If you want to fetch it from the framed page, you will be blocked by the same origin policy.
If you want to sent it from the framing page, you will be putting it in the query string and you can't trust it because it can be set to whatever the person writing the framing page likes.
There is also the X-Frame-Options header (but that has limited browser support).
The most reliable solution I can think of is:
- Require the origin to be specified in the query string used to load the frame
- Check the referer. If it doesn't match your white-list and is not blank, redirect to a page that is blank except for a link to your site with `target="_top"` and some JavaScript that `top.location = "your site"`
- Check that the origin specified in the query string is on your whitelist, if it isn't act in the same way as a rejected step 2
- Output an `X-Frame-Options` header that limits the framing to the specified origin
That is likely to catch enough browsers to discourage the framing site from framing your site.
Problem
I am developing an iframe for use on a number of our partners websites. Is there any way I can make sure it can only be used on those websites and not by anyone else I was intending to add a compulsory querystring to the URL for the website. Each partner would have a different value in the quesrystring dnd use that to look up an allowed domain However, is there anyway to know the top level domain of the site hosting the iframe? Presumably this is not sent in the http request for the iFrame? Or is it, I couldn’t see it? Or do you need to send the domain from javascript? Any advice?