title: JavaScript - window.location - Permission Denied - Cross Site Scripting
body: <p>This question is a more specific description of the problem I asked on this <a href="https://stackoverflow.com/questions/1216640/javascript-cross-site-scripting-permission-denied">thread</a>.  Basically, I have a web application for which I am trying to use Twitter's OAuth functionality. This application has a link that prompts a user for their Twitter credentials. When a user clicks this link, a new window is opened via JavaScript. This window serves as a dialog. When a user clicks the link, they are redirected to Twitter's site in the dialog. On the Twitter site, the user has the option to enter their Twitter credentials. When they have provided their credentials, they are redirected back to a page on my site in the dialog. This is accomplished through a callback url which can be set for applications on Twitter's site. </p>
  
  <p>All I am trying to do is read the URL of the window that I have opened. I am trying to read the URL to detect a change so I can react accordingly and write to the HTML DOM on the launching page. However, whenever I attempt to read the dialog window's URL, I receive a "permission denied" error. To isolate and re-create the problem, I created the following test which shows the problem.</p>
  
  <pre><code>&lt;html&gt;
    &lt;body&gt;
      &lt;input type="button" value="test" onclick="startTest();" /&gt;
  
      &lt;script type="text/javascript"&gt;
        var dwin = null;
        var timeoutID = 0;
  
        function startTest()
        {
          dwin = window.open("http://www.google.com", "dialog", "height=600,width=800", true);
          timeoutID = setTimeout("timerElapsed()", 1000);         
        }
  
        function timerElapsed()
        {
          if (timeoutID == 5)
      {
        clearTimeout(timeoutID);
        alert("We're done!");
      }
      else
      {               
        if (dwin != null)
        {
          alert(dwin.location);
        }             
        timeoutID = setTimeout("timerElapsed()", 1000);
      }
        }
      &lt;/script&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>How do I get dwin.location? I'm really confused. I didn't think this was going to be this difficult.</p>
  
  <p>Thank you for any help you can provide.</p>