为什么禁止顶部窗口访问其内部的框架？ （除非内容来自同一服务器）
我理解禁止 iframe 访问顶部窗口的原因，但反过来似乎有点不必要，并且限制了创新应用程序。
I understand the reason for forbidding iframes from accessing the top window, but the other way around it seems a bit unnecessary and restricting of innovative applications.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
能够访问子窗口中的内容实际上更危险，因为顶部窗口处于“控制之中”（即顶部窗口选择在 iframe 中显示哪个页面）。从技术上讲，无论哪种方式，威胁都是相同的，但如果恶意网站可以托管自己的 iframe，而不是希望它嵌入到目标网站中，那么恶意网站就更容易得逞。
通过阻止跨域访问内容，它可以阻止大量 XSRF 和 XSS 攻击。例如，如果我正在运行一个恶意网站，我可以简单地将隐藏的 iframe 放置在我的页面上，指向数十个热门网站，无论它们是社交网络、电子邮件、金融等。如果您已经针对其中任何一个进行了身份验证，即使在 iframe 内，您的浏览器也会发送您的会话 cookie，并且 iframe 将提供包含安全内容的经过身份验证的页面。
如果父窗口可以抓取子窗口或将新的 JavaScript 注入到要执行的子窗口中，这显然是非常糟糕的。
It's actually more dangerous to be able to access content in a child window, because the top window is "in control" (i.e., the top window chooses which page to display in the iframe). Technically the threat is the same either way, but it makes it a lot easier for a malicious web site if it can host it's own iframes, rather than hope it gets embedded in a target site.
By preventing access to the contents when they're cross-domain, it prevents a whole host of XSRF and XSS attacks. For example, if I was running a malicious web site, I could simply place hidden iframes on my page to dozens of popular sites, whether they be social networking, e-mail, financial, etc. If you were already authenticated against any of them, your browser would send your session cookies along, even within the iframe, and the iframe would serve an authenticated page with secure content.
This is obviously really bad if the parent window can scrape the child window or inject new JavaScript into the child window to be executed.
因为这将允许您相对隐形地将像 paypal.com 这样的网站放入 iframe 中，然后更改该网站，从而欺骗用户（并且可能捕获输入的凭据或银行帐户信息）。
不允许一个网站纯粹从网络上修改另一网站的行为。可以使用浏览器插件或像 Greasemonkey 这样的附加框架来修改站点的行为，但用户必须选择安装这些功能，并且假设他们只安装他们信任的功能（并不总是如此，但这就是它所依赖的）。
对于顶级框架来说，能够访问嵌入式框架可能会更加危险，因为顶级框架可以决定将哪些站点放入嵌入式框架中，从而进行攻击/混乱。
Because this would allow you to relatively invisibly put a site like paypal.com in an iframe and then change that site, thus deceiving the user (and perhaps capturing the credentials or bank account information entered).
One web site is not allowed to modify the behavior of another site, purely from the web. Modifying the behavior of a site can be done with browser plug-ins or with add-on frameworks like greasemonkey, but the user has to choose to install those capabilities and there's an assumption that they only install capabilities they trust (not always true, but that's what it relies on).
It's potentially even more dangerous for the top level frame to be able to access the embedded frames because the top level frame gets to decide which sites to put in the embedded frames and thus attack/mess with.
这与孩子对父母来说是同样的问题。您不希望恶意网站有机会弄乱它们恰好位于同一浏览器窗口中的有效网站的内容。
It's the same issue as child to parent. You don't want the chance of malicious sites messing with the content of valid sites they just happen to be in the same browser window with.