How To Know If Window.opener Comes From My Webpage?

I have a login popup that modifies its parent page with window.opener.location.href = XXX. The code goes something like this. if (window.opener) { window.opener.location.hr

Solution 1:

Not bullet-proof, but can you define some function on your main page and then test for its existence as a check that it is your page? Wrapped in a try/catch to avoid other errors when the page isn't yours?

// on parent, make this function name something unlikely to appear// on other pagesfunctioncheckParentIdentity() { return"some ID string"; }


// on popuptry {
  if (window.opener
      && window.opener.checkParentIdentity
      && window.opener.checkParentIdentify() === "some ID string") {
     window.opener.location.href = window.location.href;
     self.close();
  }
} catch(e) {
  // error message here
}

Having said that, I'm not suggesting it as a good idea, just an idea that might fit with your existing code. If it were me I'd move the location.href updating into the function on the parent, and then just have the child window call the function to tell the parent to update itself - something you could do with minimal changes to the code I posted. But then if it were me, I'd probably not use a popup at all when I can do a dynamic dialog overlay thingy on the main page (jQuery's dialog is just one easy way to do that).

And having said that, why would people have a link directly to your login page? Assuming they might, the point where you want to test whether the right parent window exists is when the login first displays, not after the user enters their details and tries to submit.