Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to access the contents of HTML tags within an iframe on a page I am developing. The parent and iframed pages have the same root domain, but different subdomains. I cannot alter the iframed page, but I can alter the parent page.

To this end, I opened Chrome via

open -a Google\ Chrome --args --disable-web-security

to let Chrome ignore the Same Origin Policy pertinent to accessing elements in an Iframe. However, Chrome still returns an error when I try to access the elements of the Iframe:

Uncaught Error: SECURITY_ERR: DOM Exception 18
Refused to display document because display forbidden by X-Frame-Options.

How do I tell Chrome to completely ignore XSS checking? Can I use command line arguments? This page on Dropbox illustrates my intention. I am trying to access the contents of the iframe. http://dl.dropbox.com/u/1531353/Misc/subDomainFrameAccess/index.html

share|improve this question
    
You don’t do this. –  kinokijuf Jun 17 '13 at 8:47

1 Answer 1

up vote 1 down vote accepted

X-frame-options is anti-clickjacking, not XSS. The page refuses to be displayed in an iframe. Can you use a popup window instead?

share|improve this answer
    
Thanks, that makes sense. I don't think I can use a popup since I'm scraping data off of a web page. Nonetheless, I've resorted to manually recording data. –  David Faux Mar 17 '12 at 21:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.