The frame requesting access has a protocol of “https”, the frame being accessed has a protocol of “http”. Protocols must match

11
votes

I'm getting this error :

Uncaught SecurityError: Blocked a frame with origin "https://lss-servicedesk.techteam.com" from accessing a frame with origin "http://mydomain.com".
The frame requesting access has a protocol of "https", the frame being accessed has a protocol of "http". Protocols must match.

<FORM ACTION=https://lss-servicedesk.techteam.com/CAisd/pdmweb.exe METHOD=POST onsubmit="return checkform(this);">

Is there any way to get around this problem ? thanks in advance...

2
javascripthtmlforms
The solution is to run SSL from your domain or grab their content over plain insecure http (if they support it) – Jamie Taylor
When do you get that error? When the HTML is parsed? – Bergi
I don't see anything referencing frames in the HTML you posted. – Barmar

2 Answers

6
votes

You're getting 2 errors here. The first one is a cross-domain problem, and you won't be able to fix that. It is impossible for your site to access the loaded iframe's site at all. Otherwise, the browser would be really insecure, allowing one site to very easily get the user's settings on another site by just loading an iframe. So, you can't change anything within the iframe. The only thing you can do to the iframe's contents is iframeElement.src = '//otherurl.com'; - changing the source url of the iframe.

To fix the second problem, you can do the following: Instead of using http:// or https:// in the url you're defining in your scripts or forms, you can just use //. That will automatically 'fill in' the same protocol as the one you're using now. So, if you're on http:// at the moment, it'll load the iframe in http:// too, and vice versa.

0
votes

I had the same issue with two different domains going to my webserver. Both of them had DNS settings set to redirect domain.com (without www) to http://www.domain.com. The one domain had issues similar to yours but it turned out that it was due to a DNS error where we had set FRAME to yes. After settings FRAME to no, it solved both issues (frame error and http/https error). It is a little thing but it caused the exact same error so just wanted to mention it as another possibility for anybody else who should stumble across this thread.