What exactly can an IFrame do with the top.Location object (cross-domain)?
问题 There is a very particular edge case in cross-domain policies regarding the window.top.Location object... Let's say I have IFrame A , in domain www.bbb.com, living inside a page in domain www.aaa.com. The page inside the IFrame can: Compare window.top.location to window.location (to detect whether it's being framed) Call window.top.location.replace(window.location) to redirect to self Call window.top.location.replace("any arbitrary string") to redirect somewhere else But it cannot: Alert,