Really need help to get iframe current url and web page DOM (overcoming same origin policy)

[styl...@gmail.com]

Dear all,

I'm working on a project utilizing GWT and GWT-Ext, has been progress
well until now where I hit a roadblock which potentially can render
the project useless.

I need to create an embedded web browser which has an address bar and
the ability to access the DOM of the current web page within my web
application. Using the Frame and IFrameElement objects in GWT and also
the ManagedIFramePanel from GWT-Ext user extension, I will get null
exception or access denied.

I realized this has to do with Javascript same origin policy where
iframe is restricted to same domain access. I tried some easier
workarounds from google search results but they don't work.

I have the following 2 questions:
- Does anyone have any workable solution to overcome this issue? No
matter how complicated it is, please share with me, really don't wish
to give up my project.

- Is there any alternative to iframe so that I can let users to surf
web pages within my web application? Or at the server side, I can do
something?

Big thanks in advance.

Regards,
Robin

[Thomas Broyer]

On 12 jan, 14:18, "style...@gmail.com" wrote:
>
> - Does anyone have any workable solution to overcome this issue? No
> matter how complicated it is, please share with me, really don't wish
> to give up my project.

Hopefully no (that would be a security breach)

> - Is there any alternative to iframe so that I can let users to surf
> web pages within my web application?

Maybe Flash could do it, though I'm not sure; you might run into the
same issue (there are ways to overcome SOP in Flash but they involve
opt-in from the "other" server)

> Or at the server side, I can do something?

Proxy the page through your own server.
Use URLs of the form http://myserver/proxy/http/otherserver/path/to/page.html
so relative references (including links and frames) still work.

You might still have to parse the HTML (use http://about.validator.nu/htmlparser/
in Java, or http://code.google.com/p/html5lib in python or ruby) to
rewrite absolute URL references (mostly links and frames), and
eventually CSS and scripts (Rhino?) too.

And of course, there might still be a web site using some
target="_top" links and/or if(window!==top)
top.location=window.location; script. Web sites will also be able to
inject anything into your application (SOP is bidirectional).
So maybe use some Flash to build a "sandboxed browser" and proxying at
your server to solve the SOP issue?

(hey, you said "no matter how complicated it is" ;-) )