title: Why do frame breakers work cross-domain, and can you conditionally use frame breakers?
body: <p>I've been investigating <a href="http://www.bloggingtips.com/2009/04/07/how-to-remove-the-digg-bar-from-your-blog/" rel="noreferrer">frame breaking</a> code recently and have come across some really bizarre behavior related to the <a href="https://developer.mozilla.org/En/Same_origin_policy_for_JavaScript" rel="noreferrer">same origins policy</a> that I am having trouble understanding.</p>
  
  <p>Suppose I've got a page Breaker.html on domain A, and a page Container.html on domain B.  The example frame breaker code would go into Breaker.html, like below:</p>
  
  <pre><code>if (top !== self) top.location.href = self.location.href;
  </code></pre>
  
  <p>This will successfully break Breaker.html out of Container.html, but I don't understand why it should.  From my reading of the same origins policy, <code>top.location</code> shouldn't be accessible <em>at all</em>, since Container.html is on a different domain than Breaker.html.  Even weirder, it appears that top.location <strong>write-only</strong>:</p>
  
  <pre><code>// Fails if Container.html is on a different domain than Breaker.html
  alert(top.location);
  </code></pre>
  
  <p>This is problematic to me because I'm trying to write code that allows my page to be in an iframe, but only if it's on the same domain as its parent (or is on a configured allowable domain) .  However, it seems to be impossible to determine this, since the same origins policy denies me access to the parent's location.</p>
  
  <p>So I've got two questions, basically:</p>
  
  <ol>
  <li><p>Why does the above frame breaker code work at all?</p></li>
  <li><p>Is there any way to break frames conditionally, or is the only check one can do is whether <code>top !== self</code>?  (In particular, I want to be able to read the domain, so that I can provide a list of allowable domains; simply checking whether I'm in the same domain or not would not be ideal.)</p></li>
  </ol>