Suppressing “permission denied” errors in Javascript

Question

I have a JS function that polls for the current url in an iframe, the purpose being to ascertain whether or not the iframe is pointing to the same site as the main document. As such, the code is basically:

function urlCheck()
{
  var location = document.getElementById('frameid').contentWindow.location.href;
  if (location)
  {
    // iframe src is currently local
  }
  else
  {
    // iframe src is currently not local
  }
}

Functionally, this code works perfectly. However, in the error console, every time this function is called and the iframe src is not local I get an error:

Permission denied for [site1] to get property Location.href from [site 2]

How can I fix my code to avoid these errors?

Thanks, Mala

Answer 1

Wrapping your code in a try-catch block should be able to catch and deal with these errors.

Answer 2

Actually, the error message is the info you want: As soon as the URL of the iframe points to a different domain, you get permission errors. This is a safety measure to avoid XSS attacks.

[EDIT] This means you can replace the code above with:

function urlCheck()
{
  try
  {
    document.getElementById('frameid').contentWindow.location.href;

    // iframe src is currently local
  }
  catch (e)
  {
    // iframe src is currently not local
  }
}