I have a webpage on domain www.example.com that has an <iframe> with a page test.html from sub.example2.com. test.html includes a JavaScript from another domain:

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.10.1/jquery.min.js"></script>

When I open www.example.com then I get an access denied error for that JavaScript.

What's the reason for that?


This is due to the "Same Origin" security policy.

The “Same Origin” policy limits the access of one window to another.

The reason behind that is security. If you have blabla.com in one window and gmail.com in another one, then you’d not want a script from blabla.com to access or modify your mail or run actions in context of gmail on your behalf.

The essence of the Same Origin policy can be formulated as: windows can work in contexts of each other only if they are from same protocol://domain:port, or, shortly, from same origin.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.