How to resize an iframe (HTTPS) from a site (HTTP) under the same domain

Question

I have a site that host some public content: https://secure.example.com/PublicContent.html . I am rendering it through an iframe on an unsecured site: http://public.example.com . I have both pages setting document.domain = "example.com"; .

If I load public.example.com using HTTPS, I can have the iframe resize correctly using the onload attribute:

onload="this.style.height = this.contentWindow.document.body.scrollHeight + 'px';"

However, if I load public.example.com without HTTPS, I get Access is denied. Any ideas how to get this to work on HTTP?

Answer 1

Not possible if you're using this.contentWindow

Same-origin policy: https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy

Two pages have the same origin if the protocol, port (if one is specified), and host are the same for both pages.

To share information between the same domain no matter which protocol used, you might want to take a look at cookies. https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#Cross-origin_data_storage_access .

Also, used this lib to solve a similar issue: https://github.com/davidjbradshaw/iframe-resizer