Cross Domain Submit

J

jmm223

Junior Member

Apr 10, 2007

106

37

• Feb 5, 2009

• #1

Ok, I have been searching for this for at least a week, and have been driving myself crazy trying tons of code snippets, etc...
I believe it is possible, so I was hoping someone could point me in a good direction, or tell me that it doesn't exist.

Hypothetically, say I am iframing a zip submit offer (just the form part) and I want to make something happen once they have submitted the form. (i.e. break out of the frame, and reveal the actual submit destination)

When dealing with a cross-domain situation, How do I either:
A) put a button on my page that submits the iframed form.
or
B) detect when the iframed form has been submitted.
or
C) maybe there is some method that I haven't thought of?

Any help is greatly appreciated.

 

Grizzy

Senior Member

Nov 11, 2008

920

1,005

• Feb 5, 2009

• #2

Well I've never done this myself but I think that this would be possible with the 'on submit' event, which occurs when the submit button is clicked.

Code:

<form name="zipform" action="whateverscript" 
onsubmit="window.location='http://www.example.com/'">

Just a thought. I haven't tested that. GL.

 

J

jmm223

Junior Member

Apr 10, 2007

106

37

• Feb 5, 2009
• Thread Starter Thread Starter

• #3

Thanks Grizzy, however that isn't what I am looking for.

I need to submit a form that is on an external site, or at least check to see when it is submited.

 

Grizzy

Senior Member

Nov 11, 2008

920

1,005

• Feb 5, 2009

• #4

Ok sorry, I see what your getting at here. So basically you are asking if it is possible for to detect activity in an iframe that
references a foriegn domain? No, I don't think it is possible, this would be a big security hole and is a no no for browsers. If you were able to do this, you would be moving into the realm of blakhat browser hacking (or cross-site scripting!). I could be wrong about this tho...

 

J

jmm223

Junior Member

Apr 10, 2007

106

37

• Feb 5, 2009
• Thread Starter Thread Starter

• #5

Yes, now you understand.

I am beginning to think it isn't possible as well...except I keep seeing people that claim they are doing it, and that it IS possible. But they won't talk about how of course.

 

WickednDivine

Elite Member

Jr. VIP

Jul 29, 2008

2,291

646

• Feb 5, 2009

• #6

this would be considered XSS, I dont think it's "supposed" to be possible, but you might be able to find some workarounds. google "XSS form submit" or something

 

B

blazed

Junior Member

Aug 15, 2008

178

122

• Feb 5, 2009

• #7

browsers prevent this from happening, if you are able to do what you are trying to do then you have effectively found a security hole in the browser you are using...

 

J

jmm223

Junior Member

Apr 10, 2007

106

37

• Feb 5, 2009
• Thread Starter Thread Starter

• #8

Wow...there is some interesting stuff involved in XSS...mostly involving stealing info.

I thought I was on to something, but again...no luck.

But again, I am not trying to steal any data, or even send fake info to the form...I just want to click the button on the iframed page. (or know when the user clicked the button)

 

C

cyklotrial

Regular Member

Oct 13, 2008

248

82

• Feb 5, 2009

• #9

Try this:

HTML:

<script type="text/javascript">
var buttonclick = true;
</script>

<iframe src="http://google.com" onload='if (!buttonclick) { alert("WOW") } else { buttonclick = false; }'></iframe>

When the page in the frame will change (somebody will send the zip form) you will see allert.
There is a method to intercept data which somebody will write down in form in the iframe - But it isn't perfect method.

Ps. You can hide this JS code in jquery file and almost nobody will see it

Regards

 

B

blazed

Junior Member

Aug 15, 2008

178

122

• Feb 5, 2009

• #10

cyklotrial said:

Try this:

HTML:

<script type="text/javascript">
var buttonclick = true;
</script>

<iframe src="http://google.com" onload='if (!buttonclick) { alert("WOW") } else { buttonclick = false; }'></iframe>

When the page in the frame will change (somebody will send the zip form) you will see allert.
There is a method to intercept data which somebody will write down in form in the iframe - But it isn't perfect method.

Ps. You can hide this JS code in jquery file and almost nobody will see it

Regards

Click to expand...

I think it might also be possible to do something crafty if you have your AM place a tracking pixel for you on the conversion page...

 

J

jmm223

Junior Member

Apr 10, 2007

106

37

• Feb 5, 2009
• Thread Starter Thread Starter

• #11

Cyk...that is EXACTLY what I needed.
I think I love you.

 

C

cyklotrial

Regular Member

Oct 13, 2008

248

82

• Feb 5, 2009

• #12

blazed what do you mind?

 

B

blazed

Junior Member

Aug 15, 2008

178

122

• Feb 5, 2009

• #13

Lots of advertisers & affiliates like to use tracking pixels to keep track of conversions. A tracking pixel is a 1x1 img or iframe hosted on the advertiser's tracking server. So it looks invisible, but every time it's displayed an advertiser sees that request and knows they made a sale.

Potential for evil is here: Lets say you get your AM to agree to let you use your own tracking pixel on the page after the conversion. You would then have pretty much circumvented the cross domain restrictions...

 

195471

Regular Member

Oct 11, 2008

415

264

• Feb 5, 2009

• #14

LostShootingStar said:

this would be considered XSS, I dont think it's "supposed" to be possible, but you might be able to find some workarounds.

Click to expand...

It's possible, but the workarounds that I've seen all involve modifying some code on the external domain, which you wouldn't have access to unless you either owned it or had the cooperation of the other webmaster.