Under what conditions can I access the HTML-DOM of a child IFrame from the hosting website?

What can c开发者_运维百科ause my website to not have access to a child IFrame's DOM via Javascript? Are there cross-domain restrictions in place? Does HTTPS play a role?

You can only access iframes if they are coming from the same domain. If you are hosting www.mysite.com and the iframe inserted is from www.yahoo.com you cannot access it. Trying to do that will get an access denied javascript error. This is one of the checks to avoid cross site scripting I believe.

You can't do it across domains, and this extends to subdomains as well as across SSL. The child however can access the parent.