title: Allowing HTTP iFrame to call JavaScript on HTTPS parent frame
body: <p>I have an https page (<a href="https://example.com/main.php" rel="noreferrer">https://example.com/main.php</a>) that has an iframe with a non-https source (<a href="http://example.com/inner.php" rel="noreferrer">http://example.com/inner.php</a>). Both files are on the same server - just one is accessed with https and the other is not. I need the non-https page to be able to execute javascript on the https <code>main.php</code> page using code such as <code>parent.myfunction()</code></p>
  
  <p>However, when I try this, I get the following error:</p>
  
  <blockquote>
    <p>Unsafe JavaScript attempt to access frame with URL <a href="https://example.com/main.php" rel="noreferrer">https://example.com/main.php</a> from frame with url <a href="http://example.com/inner.php" rel="noreferrer">http://example.com/inner.php</a>. Domains, protocols and ports must match.</p>
  </blockquote>
  
  <p>I have set <code>document.domain = 'example.com'</code> on both files and I thought that would fix it, however, it does not. Is there any way to allow the frame to execute javascripts on the parent frame and vice-versa? If so, what are the security implications of this?</p>
  
  <p>PS: For those of you that will suggest just using https or http for both pages, I am looking into that. However, due to the processes occuring in the iframe page, this might not be a a feasible option due to server load issues.</p>