1

I am trying to access the contents of HTML tags within an iframe on a page I am developing. The parent and iframed pages have the same root domain, but different subdomains. I cannot alter the iframed page, but I can alter the parent page.

To this end, I opened Chrome via

open -a Google\ Chrome --args --disable-web-security

to let Chrome ignore the Same Origin Policy pertinent to accessing elements in an Iframe. However, Chrome still returns an error when I try to access the elements of the Iframe:

Uncaught Error: SECURITY_ERR: DOM Exception 18
Refused to display document because display forbidden by X-Frame-Options.

How do I tell Chrome to completely ignore XSS checking? Can I use command line arguments? This page on Dropbox illustrates my intention. I am trying to access the contents of the iframe. http://dl.dropbox.com/u/1531353/Misc/subDomainFrameAccess/index.html

1
  • You don’t do this.
    – kinokijuf
    Jun 17, 2013 at 8:47

2 Answers 2

1

X-frame-options is anti-clickjacking, not XSS. The page refuses to be displayed in an iframe. Can you use a popup window instead?

1
  • Thanks, that makes sense. I don't think I can use a popup since I'm scraping data off of a web page. Nonetheless, I've resorted to manually recording data.
    – David Faux
    Mar 17, 2012 at 21:01
0

Please comment on the chrome bug list so the chrome devs hear our collective cries!

https://bugs.chromium.org/p/chromium/issues/detail?id=857032

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .