Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an increasingly frustrating problem with the firefox implementation of the same origin policy.

I am developing an integrated system with touch screen support, and we have the user option of loading web pages in iframes in several locations on the screen. The web pages can be any kind of webpages from any kind of domain and location (google, yahoo, intranet pages etc) and herein lies my problem.

I need to be able to add an onclick event to the iframe, that gives me the id of the iframe (or some other unique identifier) as a response. This tells me that activity (web browsing) is underway on the iframe and that the iframe should not be reloaded (the pages are set for a fixed automatic update interval that should be interrupted on activity.

I have read just about everything google returns me (but I would love to be disproven in this matter) and I have found this to be the best (among a lot of other) solution:

<iframe src='' id='iframe1' onload='"UniversalBrowserWrite"); this.contentWindow.document.addEventListener("click", function(event) {alert(;}, false)'></iframe>

This just gives me the regular permission denied for http://localhost to get property Window.document from

I know why I get this error message, and my question is simple. How do I remove it?

It is an integrated system, I can compile firefox from source, I can edit the source code if needed, I can change prefs.js etc. but I need to use firefox (I know all other sensible web browsers has a nice command line switch to turn it off...) but we have a (quite) tight integration with the firefox platform that would be hard to remove.

We currently use Firefox v.3.5.16 (I know it's EOL, we are going to upgrade it some other time) on a Debian Squeeze platform. If needed I can upgrade to a newer Firefox version, but from what I have found it seems to fare even worse in this matter.

TL;DR Help me to shut of same origin policy, in any way possible on Firefox 3.5.16 for an integrated platform that needs to alter code through cross domain iframes.

share|improve this question
Oh, and just to clarify it only needs to work in firefox. Just any solution at all would suffice at this stage! – Knuwgljung May 8 '12 at 10:38
My supplied code example uses the first link (and I have tried the CORS addon) to no use, it's still not working! The other link is for Firefox 5, where enablePrivilege is removed! – Knuwgljung May 8 '12 at 16:16
up vote 2 down vote accepted

I feel quite stupid.

It works when you use UniversalXPConnect instead of UniversalBrowserWrite.

For example:"UniversalXPConnect");

Also, you can not use or, that still gives a (different) access error. To defeat that problem just store it in a temporary variable first:

onload='var tempstuff =; this.contentWindow.document.addEventListener("click", function(event) {alert(tempstuff);}, false)'
share|improve this answer
This answers my own question, no further responses are needed! If anyone could mark this question as answered I would appreciate it (I can't mark my own answer for two days). – Knuwgljung May 8 '12 at 18:52
Then you have to wait, I can't marked it either ;) – Huygens May 8 '12 at 21:40
Doest that still work? I guess no. – erm3nda Feb 16 '15 at 6:53
If I remember correctly, we still use this method with Firefox 33, so it should still work properly. – Knuwgljung Feb 17 '15 at 9:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.