I need to pass URLs to a client and they would embed those URLs on their site within an Iframe. I was wondering what's stopping the user(who is visiting the client site) from copying the URL from the IFrame source to use it somewhere else?

I want the URL to be used only to the client that I provide to.

Update: I was thinking of adding an extra parameter in the URL, that I am passing to every client, to identify which client it is and if the request is coming from the same client, but I can't find any way to have an access to the information where the request is actually coming from? In short IFrame doesn't have access to it's parent.


2 Answers 2


When an iFrame is used in a page, it sends a referer (sic) HTTP header of the page that it was included in.

You could configure your server to check that the referrer is the correct page for your URL.

Alternately, you could use JavaScript to check it using document.referrer.

See: http://www.nczonline.net/blog/2013/04/16/getting-the-url-of-an-iframes-parent/


Would it be feasible to issue each client that intends to use this URL with security parameters(username/password) which inturn could be supplied as HTTP security headers to the URL which are then authenticated on your site?

  • How would client supply HTTP security headers to the URL? What clients would be doing is essentially adding that url in an Iframe on their site.
    – user3614511
    Jul 2, 2014 at 2:03
  • I'm assuming you are using javascript on the site this iframe is in, regretfully I'm not too aux fait. I know in Java with something like httpcore there are methods when you are crafting your request you can add http headers EG: hc.apache.org/httpcomponents-core-ga/httpcore/apidocs/org/…
    – user3465651
    Jul 2, 2014 at 6:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.