Question: How can I allow frames from two different domains to SAFELY
interact within a browser and exchange information during a single
session?

Background: I am trying to develop a web-based application that will
allow cross-domain interactions between two frames within a browser.
This seems to violate
security restrictions regarding interaction between frames from
different domains. We would like to temporarily bypass these
cross-domain security restrictions for a single user during a single
session without compromising anyone's security.

This is necessary to provide a web-based system that doesn't require
downloads, but I can't see how to do it without security risk.

(For instance, if that info exchange between frames were permitted,
the host site could load a 0 pixel frame that monitors the visitor's
web surfing, and tracks the visitor's actions.)

Is there a way to do this and still keep this as a web-based program
that doesn't require any downloads? (I suppose a temporary cookie
would be OK.)

Here is a link to another comment on the same
topic.....<http://www.irt.org/script/1111.htm>

---

Request for Question Clarification by leapinglizard-ga on 23 Apr 2006 16:18 PDT

I can think of various ways to bypass the security restrictions, but
the right approach depends on what you're trying to accomplish. Can
you give me a few examples of the kind of cross-domain interaction
you'd like to implement?

leapinglizard

---

Clarification of Question by zurlit-ga on 24 Apr 2006 21:36 PDT

We have control over one of the two domains that are interacting.

The toolbar frame needs to be able to monitor the browsing frame for
its current location and/or be notified of a change in its status when
the URL changes ie: The user clicks a link.

Does that help to clarify the situation?

Thanks,
Zurlit

---

Request for Question Clarification by leapinglizard-ga on 25 Apr 2006 07:12 PDT

In my view, your objective has little to do with frames or even with
cross-domain interaction. What you really want is a way to know what
the user's browser is doing. I don't see how you can accomplish this
without writing a browser plugin.

leapinglizard

Directly from the link you posted:

Only if the url in the other frame comes form the same server as the
page that 'snoops' - otherwise a security error occurs.


Now, depending on what you're attempting you may be able to do a
work-around of sorts.
- What's the final result you're looking for?
- What's your definition of "interactions"?
- Why do the domains have to be different?  
- Do you have control over each one?

modify document.domain
see http://msdn.microsoft.com/workshop/author/dhtml/reference/properties/domain.asp

http://javascript.about.com/od/reference/a/frame3.htm