Prerequisites:
I have one page loading from http://localhost:8081/. The page contains two iframe elements.
<iframe src="http://localhost:5000/" name="preview"></iframe>
<iframe src="http://localhost:5000/" name="editor"></iframe>
The page loading from http://localhost:5000/ contains two links. The document includes the tag base with the attributes href and target.
This is a copy of this document.
<!doctype html>
<html lang=en>
<head>
<meta charset=utf-8>
<base href="http://localhost:8081/" target="editor" />
</head>
<body>
<a href="/editor.html">Load editor one</a>
<a href="/editor2.html">Load editor two</a>
</body>
</html>
The editors are simple documents with one input so I leave those out for brevity.
Problem:
So from the start the origin is http://localhost:5000/ for both iframes. When I click one of the links it loads into the iframe with name="editor" I believe the origin is changed to http://localhost:8081/. That means that when I click one of the links again to load the other editor I get the following error:
Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://localhost:8081/editor.html' from frame with URL 'http://localhost:5000/'. The frame attempting navigation is neither same-origin with the target, nor is it the target's parent or opener.
I have full control over both origins and environments. Is it possible to set an HTTP header or any tag or attribute that make this solution play nice within the security constraints?
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
