javascript - Get height of iframe with external URL - Stack Overflow

admin管理员组

文章数量:1291121

I have to include an external whitelabel site within an iframe on my page. There are numerous pages on the external site and they vary considerably in height.

I need to adjust the height of my iframe to acmodate this.

I can get the height of the first page loaded into the iframe (using PHP), but no way of getting subsequent page heights because no way of knowing what the url/location changes to in the iframe.

As this is an external url in the iframe the usual security limitations apply, therefore ALL solutions must e from the parent frame. Solution must be workable on FF and IE at least.

The only think I can think of is to test whether the scrollbars are visible on the iframe, but this is seemingly impossible in these circumstances.

If anyone can prove me wrong, or has any other javascript/ajax/php cross-browser solution I'd love to hear it.

I have to include an external whitelabel site within an iframe on my page. There are numerous pages on the external site and they vary considerably in height.

I need to adjust the height of my iframe to acmodate this.

I can get the height of the first page loaded into the iframe (using PHP), but no way of getting subsequent page heights because no way of knowing what the url/location changes to in the iframe.

As this is an external url in the iframe the usual security limitations apply, therefore ALL solutions must e from the parent frame. Solution must be workable on FF and IE at least.

The only think I can think of is to test whether the scrollbars are visible on the iframe, but this is seemingly impossible in these circumstances.

If anyone can prove me wrong, or has any other javascript/ajax/php cross-browser solution I'd love to hear it.

• javascript
• security
• iframe

Share Improve this question Follow edited Mar 26, 2014 at 18:49 Day 9,70366 gold badges6060 silver badges9595 bronze badges asked Oct 30, 2010 at 10:17 OwenOwen 7,5971212 gold badges5555 silver badges7474 bronze badges 2

• See this question: stackoverflow./questions/466672/… – Zach Commented Nov 1, 2010 at 21:40
• Yes I saw that question. But here I stated it emphatically "ALL solutions must e from the parent frame". Most suggestions I've seen involve coding of some kind on the remote page. – Owen Commented Nov 2, 2010 at 13:10

Add a ment  | 

1 Answer 1

Sorted by: Reset to default 9

It is not possible to do this because of the browser's security model. If it was possible, that would be a security problem and would have to be fixed.

Although letting the embedding site know the height of a third party webpage when embedded in the page seems harmless, this can leak information to the embedding site that the browser's user wants to keep private. For example, http://www.facebook./ renders differently depending on whether or not you are logged in, so if my website can work out the height of <iframe src="http://www.facebook./"> then I can work out whether or not you are a facebook user, something you probably don't want me to know.

The information leakage would be similar to the infamous CSS History Leak in that it would reveal information about the user's relationship with the third-party site just by "linking" to that site (in this case with an iframe instead of a link). Browser vendors had to plug the CSS History Leak, so I suspect if you could work out the height of a third party site rendered in an iframe in any browser, the vendor would have to fix that too.

The information leaked would be anything that can be inferred from the height of a page when rendered for a user using their cookies (which the browser will send even though rendering in an iframe inside a different domain's page). The specific risks depend entirely on the nature of the embedded site being "attacked". E.g. I could get an idea of how much stackoverflow activity someone visiting my site has by getting the height of https://stackoverflow./reputation which is different for different users.

本文标签： javascriptGet height of iframe with external URLStack Overflow