Permission denied to access property on cross-origin object
Firefox throws this error when your script reads a property of a frame from another origin, such as `document`. The same-origin policy blocks it. Use postMessage to pass data between the two pages.
- Chrome
- Edge
- Firefox
Updated
Permission denied to access property "document" on cross-origin object
The frame looks fine. Your script stops with a SecurityError.
Permission denied to access property "document" on cross-origin object
The frame looks fine. Your script stops with a SecurityError.
Failed to read a named property 'document' from 'Window': Blocked a frame with origin "https://your-site.com" from accessing a cross-origin frame.
On this page
What it means
Why it happens
Check the page
See the headers the page sends now
Fix it if you own the site
// In the framed page (https://example.com)
window.parent.postMessage({ height: document.body.scrollHeight }, "https://your-site.com");
// In your page (https://your-site.com)
window.addEventListener("message", (event) => {
if (event.origin !== "https://example.com") return;
iframe.style.height = `${event.data.height}px`;
});If you do not own the site
- Use postMessage
Ask the owner of the framed page to send the data you need with postMessage.
- Use an API
Many services give an API or an embed SDK for the data that the page shows.
- Read it on your server
Get the data with a request from your server, where the same-origin policy does not apply.