Permission denied for access to the Arbitrator resource

Question

I have an iframe FB application. We have three places where we develop it: my local host, the stage server on which we test the application, and the production server. The local host and production have HTTPS. In local and stage applications, sandbox mode is enabled. All versions of the application are identical, the code is the same. Stage and production - this is completely the same server machine with the same settings, except for HTTPS.

Now, what happens only on my server application . When I click on where to invoke the JQuery UI dialog, it causes the following error in my Firebug: Permission denied to access property 'Arbiter' . In this case, the dialog will not be called. He somehow raised the dynamically loaded canvas_proxy.php file in this code:

 /** * Parses the fragment and calls Arbiter.inform(method, params) * * @author ptarjan */ function doFragmentSend() { var location = window.location.toString(), fragment = location.substr(location.indexOf('#') + 1), params = {}, parts = fragment.split('&'), i, pair; lowerPageDomain(); for (i=0; i<parts.length; i++) { pair = parts[i].split('=', 2); params[decodeURIComponent(pair[0])] = decodeURIComponent(pair[1]); } var p = params.relation ? resolveRelation(params.relation) : parent.parent; // The user is not inside a frame (probably testing on their own domain) if (p == parent || !p.Arbiter || !p.JSON) { return; } p.Arbiter.inform( 'Connect.Unsafe.'+params.method, p.JSON.parse(params.params), getBehavior(p, params.behavior)); } 

The line if (p == parent || !p.Arbiter || !p.JSON) { calls it. My script code binding the JS API looks like this:

 <script src="https://connect.facebook.net/en_US/all.js#appId=APPID"></script> 

Does anyone have a clue why this could happen? I found this and this , but these problems do not seem to be useful to me (or I just do not understand). Maybe due to HTTPS? Why did he work the day before yesterday? I'm desperate: - (

Answer 1

whenever you have a permission denied message and you are dealing with frames or iframes, this is a problem with the document domain. One document belongs to domain x, and the other to domain y. And note that www.domain.com and domain.com are not the same document domains!

When you click on the DOM of one framed document from another, (whether for the purpose of changing the values ​​of a page element or just reading the values ​​of some hidden variable or URL, etc.), you will get permission denied if both frame documents are not Served from the same / identical domains.

So, if one frame belongs to www.mydomain.com, and the other is just mydomain.com or www.someotherdomain.com, you get this bloody permission that denies an error.

And there is no way around this. And if it were, the identity theft problem would instantly break.