不要让父网站从我的iFrame获取信息

Question

I have to make an iFrame that will manage user's sensible information. I need the parent page not to be able to get information from it. What can you recommend me to achieve this goal?. I already saw how to obfuscate my javascript code, but its not enough I need to be impossible to have access from the website to some iFrame's values that are inside some fields that the user will fill up.

For example I try making my own frame and web to test the security and if I put this on the web: iFrameName.document.getElementById("idTextField").value; I get the text that the client filled, thats what I want to prevent, to be impossible (or very difficult) for the web to get the data of the fields I have in my iFrame.

Thank you all.

By the way Im using HTML, JS and PHP

Answer 1

http://javascript.info/tutorial/same-origin-security-policy

Because of Same Origin policy in Javascript, from javascript is impossible to have access to an iFrame if both (parent and iFrame) are located in different domains.

"So, iframe.contentWindow.document will be the inner document. You can access it or modify from parent window if both iframe and the parent come from one domain/host/port (security limitations are discussed more in detail in the next sections)." Text From: http://javascript.info/tutorial/frames-and-iframes