Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to pass URLs to a client and they would embed those URLs on their site within an Iframe. I was wondering what's stopping the user(who is visiting the client site) from copying the URL from the IFrame source to use it somewhere else?

I want the URL to be used only to the client that I provide to.

Update: I was thinking of adding an extra parameter in the URL, that I am passing to every client, to identify which client it is and if the request is coming from the same client, but I can't find any way to have an access to the information where the request is actually coming from? In short IFrame doesn't have access to it's parent.

share|improve this question

migrated from stackoverflow.com Jul 2 '14 at 18:31

This question came from our site for professional and enthusiast programmers.

up vote 0 down vote accepted

When an iFrame is used in a page, it sends a referer (sic) HTTP header of the page that it was included in.

You could configure your server to check that the referrer is the correct page for your URL.

Alternately, you could use JavaScript to check it using document.referrer.

See: http://www.nczonline.net/blog/2013/04/16/getting-the-url-of-an-iframes-parent/

share|improve this answer
Referer in HTTP Header did the job. Thanks! – user3614511 Jul 2 '14 at 3:55

Would it be feasible to issue each client that intends to use this URL with security parameters(username/password) which inturn could be supplied as HTTP security headers to the URL which are then authenticated on your site?

share|improve this answer
How would client supply HTTP security headers to the URL? What clients would be doing is essentially adding that url in an Iframe on their site. – user3614511 Jul 2 '14 at 2:03
I'm assuming you are using javascript on the site this iframe is in, regretfully I'm not too aux fait. I know in Java with something like httpcore there are methods when you are crafting your request you can add http headers EG: hc.apache.org/httpcomponents-core-ga/httpcore/apidocs/org/… – user3465651 Jul 2 '14 at 6:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.