Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm embedding an application via iframe into a someones site and need to be able to call a few of their javascript functions. Clearly running a top.cart.add() gets blocked by the same-origin policy. We've exhausted most of our options when it comes to getting them to set something up for us, so we need to try to work around them. Someone mentioned that having them set up a CNAME record could allow us to execute cross domain javascript. Is that possible? If so, how does that work. If not, how would you recommend I approach this?

share|improve this question
up vote 4 down vote accepted

Yes, a cname would work. The simple reason is that the browser/java will use the host directive, which is obtained from the hostame entered in the address bar, or specified in the code of the webpage when it pulls up additional objects.

The way cname works, is it responds to requests for and responds with another dns name, say, which is queried by the resolver. This is all done by the resolver, and is separate from what is going on with app/browser, so it's "transparent" (For lack of a better descriptive word right now).

if the webpage is at, but your app is from, you can ask them to create a cname for or something, that points to The only other thing you need to then do is create a vhost on your webserver that listens for as well as - if you are using vhosts.

share|improve this answer
Great answer. Thanks for the explanation – Brad Herman Apr 14 '11 at 14:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.