Parent Content Script Messaging to Iframe Content Script

[Scott Fortmann-Roe]

I have a window with a cross origin iframe in it. The extension has a content script in both the parent window and the iframe'd window.

I would like to send a message from the parent window's content script to the iframe window's content script.

I don't see a reliable mechanism for this though. I've explored two options:

1) Some form of direct Content Script to Content Script communication. This is not possible as the same origin policy also applies to content scripts so access to the iframe'd window isn't possible from the parent content script.

2) Pass a message via the Background Script. The parent content script can send a message to the background script which will then relay the message to the iframed content script. However, to do this, I need the frameId for the iframe'd window (there may be many iframe'd windows in the page) but I don't see a way for the parent content script to access that.

What would be the best way to approach this?

thank you, Scott

[wOxxOm]

As you already know #1 isn't possible. Someone who doesn't care about reliability could have used cross-frame messaging via frameWindow.postMessage but it can be intercepted and it can also break sites that already use it themselves and don't expect third parties to use it at all.

The #2 option is the only method - simply send the message to all frames (sendMessage already does that by default when you don't specify frameId) and let the frame's content script decide whether it should respond. Once it's decided you can save the frame id and use it in the relay.

[Scott Fortmann-Roe]

Thank you, but I am not sure that would work.

For context, I am trying to focus the next focusable element in the page as if the user pressed the tab key (in a generic way that should work on any site so the next focusable element may or may not be in an iframe).

So the parent window is deciding which iframe window should respond next (the next potentially focusable one in relation to the currently focused element) not the iframe windows.

[wOxxOm]

Indeed this won't work with #2 so you'll have to use cross-origin postMessage e.g. frameElement.contentWindow.postMessage('focus', '*') and listen to `message` on `window` as described in the documentation. As I already warned this may break functionality of some sites.

[wOxxOm]

I have an idea: use focus.

// main content script

iframe.focus();

chrome.runtime.sendMessage('moveFocus');

// background script sends the message to the entire tab

chrome.runtime.onMessage.addListener((msg, sender) => {

  if (msg === 'moveFocus') {

    chrome.tabs.sendMessage(sender.tab.id, msg);

  }

});

// frame content script

chrome.runtime.onMessage.addListener(msg => {

  if (msg === 'moveFocus' && window !== top && document.hasFocus()) {

    moveFocus();

  }

});

[Scott Fortmann-Roe]

That focusing approach is a very interesting idea. In effect 'marking' the targeted iframe without violating CORS.

I'll explore it further.

Thanks! Scott