Javascript HTTPS-Frame对父HTTP-Frame的访问

Question

How can an IFRAME with URL https://domain/ access the DOM of the parent frame which has URL http://domain/ (HTTPS calls HTTP)?

Both frames will cooperate. The domain is the same in both frames, just the protocol is different . Setting document.domain is not allowed as that would allow for XSS attacks coming from other untrusted frames.

As an alternative to accessing the DOM it would be enough to send a message (containing a single integer). Notice, that the postMessage API only works in IE8+. I need IE6+ .

Answer 1

Is easyXDM an option. It supports postMessage for browsers with support, and falls back to other mechanisms for older browsers. Some of the mechanisms are a bit hacky but they work.

But why do you want to have a secure iframe on an insecure page?