iframe的远程主机

Question

I have iframes over various websites. In my js, I'm hitting against a php file in a different domain. Is there a way to get the domain name for the server on which my iframes are hosted. (This is to prevent others hitting against my php file).

Example. I have a domain called www.domain.com and another call www.phpscript.com If my website is embeded in yahoo. Is there any way that I can find out that my js calls are coming from www.domain.com and not some dodgy website?

$_SERVER['REMOTE_HOST'] and $_SERVER['REMOTE_ADDR'] would not work in this situation, as REMOTE_ADDR would provide the users IP and REMOTE_HOST would return yahoo.

Answer 1

EDIT:

The OP wanted to do the reverse of what I initially interpreted the question as.

To prevent a site being accessed when it IS NOT in an iframe, you can use:

<script type="text/javascript">
if (window.top === window.self) {

    window.self.location = 'about:blank'; 
    window.self.onload=function(evt){ 
        window.self.location = 'about:blank'; 
        document.body.innerHTML=''; 
    };
    document.body.innerHTML='';
}
</script>

This requires JavaScript to be enabled, and will blank the page and redirect to about:blank (nothing) if the page is accessed outside of an iframe.

---

To preventing a page from being accessed when it IS in an iframe (original answer, still useful).

You can send the header X-Frame-Options: SAMEORIGIN (what Google does) to ask the browser to not display the content in a frame that's not on your domain.

PHP

header('X-XSS-Protection: 1; mode=block');
header('X-Frame-Options: SAMEORIGIN');

You could additionally work around this with JavaScript to stop access to the site through iframes:

if (window.top !== window.self) { 
    window.self.location = 'about:blank'; 
    window.self.onload=function(evt){ 
        window.self.location = 'about:blank'; 
        document.body.innerHTML=''; 
    }; 
    document.body.innerHTML='';
}

Both of these methods rely on the browser support, but it's better than nothing.