how can I check if a javascript chat inside an iframe is within the correct parent page

Question

I want to prevent anyone else from copying the iframe code and placing the chat into their own webpage. I need a way to check the url of the parent page containing the iframe or something. I could do something with cookies if required. Any suggestions?

Answer 1

You can add the header X-Frame-Options: SAMEORIGIN on the iFrame page, preventing to the page to be display in a iFrame outside the same origin (ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options ).

If the chat is communicating with the server, you can prevent other site to do so by making sure CORS check done by browser will not authorize other site to make the request to you server. You can also add some temporary authorization key in the send Javascript to prevent the use of your server out side browser.

You can add some Javascript code that make extra checks but some one can remove them and re-use your code. You are sending the code, there is no way to prevent someone that have access to it to read it and try to do the same thing. By sending the code you lose any tight control you may want.