Custom Window - Security Error with iframe

Hi All

I am trying to pull together a flight recording app that reports back to a webserver and I’m at the stage of trying different things to check the technology works. So far I’ve been able to use the custom window to send sim data to my webserver and record this in a db. (I’m a PHP dev so that bit is the easy bit)

I’m using a custom window to display my website/app pages in sim as I really like the usabilty of keeping everything in game/sim.

I am generating flights to be recorded and using postMessage / addEventListener in javascript to tell it to start recording. This is working well, I am sending back to the webserver the speed, lat/long etc and recording this in a csv file.

I’m stuck with an issue that I’m seeing in the console however. When I start the flight it is recording really well, the minute I move my mouse to interact with something I get the following…

This then throws out my tracking code and it stops working :frowning:

This is the code I have in the JS file which is the parent and the site is displayed in an iframe in the custom window.

Anyone know where I’m going wrong?

var IngamePanelCustomPanelLoaded = false;
document.addEventListener('beforeunload', function () {
    IngamePanelCustomPanelLoaded = false;
}, false);

class IngamePanelCustomPanel extends HTMLElement {
  constructor() {
  window.customElements.define("ingamepanel-flightcase", IngamePanelCustomPanel);

  window.onload = function() {

    //listen to messages being sent to the page
    window.addEventListener("message", function(event) {

      active =;
      preFlight =;
      endFlight =;

      if (preFlight) {
        var preFlightMsg = {
          acReg : SimVar.GetSimVarValue("ATC ID", "string"),
          acType: SimVar.GetSimVarValue("TITLE", "string"),
          acFuel: SimVar.GetSimVarValue("FUEL TOTAL QUANTITY", "TYPE_FLOAT64"),
          acFuelWeight: SimVar.GetSimVarValue("FUEL TOTAL QUANTITY WEIGHT", "TYPE_FLOAT64"),
          acEngType: SimVar.GetSimVarValue("ENGINE TYPE", ""),
          acNumEng: SimVar.GetSimVarValue("NUMBER OF ENGINES", "TYPE_UINT16"),
          conn : true
        var frame = document.getElementById('CustomPanelIframe');
        frame.contentWindow.postMessage(preFlightMsg, '*');

      if (endFlight) {
        console.log('Flight Ended');
        var endFlightMsg = {
          tdBankAngle: SimVar.GetSimVarValue("PLANE TOUCHDOWN BANK DEGREES", "TYPE_FLOAT64"),
          tdLat: SimVar.GetSimVarValue("PLANE TOUCHDOWN LATITUDE", "TYPE_FLOAT64"),
          tdLong: SimVar.GetSimVarValue("PLANE TOUCHDOWN LONGITUDE", "TYPE_FLOAT64"),
          tdSpeed: SimVar.GetSimVarValue("PLANE TOUCHDOWN NORMAL VELOCITY", "TYPE_FLOAT64"),
          tdPitch: SimVar.GetSimVarValue("PLANE TOUCHDOWN PITCH DEGREES",  "TYPE_FLOAT64"),
          tdRunway: SimVar.GetSimVarValue("ON ANY RUNWAY", "TYPE_BOOL"),
          tdMaxG: SimVar.GetSimVarValue("MAX G FORCE", "TYPE_FLOAT64"),
          tdMinG: SimVar.GetSimVarValue("MIN G FORCE", "TYPE_FLOAT64"),
          tdFuel: SimVar.GetSimVarValue("FUEL TOTAL QUANTITY", "TYPE_FLOAT64"),
          tdFuelWeight: SimVar.GetSimVarValue("FUEL TOTAL QUANTITY WEIGHT", "TYPE_FLOAT64"),
          tdAirport: SimVar.GetSimVarValue("ATC RUNWAY AIRPORT NAME", "string"),
          tdAirport2: SimVar.GetSimVarValue("GPS APPROACH AIRPORT ID", "string"),
          lat: SimVar.GetSimVarValue("PLANE LATITUDE", "degree latitude"),
          long: SimVar.GetSimVarValue("PLANE LONGITUDE", "degree longitude"),
          speed: SimVar.GetSimVarValue("AIRSPEED INDICATED", "knots"),
          heading: SimVar.GetSimVarValue("HEADING INDICATOR", "knots"),
          conn : true
        var frame = document.getElementById('CustomPanelIframe');
        frame.contentWindow.postMessage(endFlightMsg, '*');

      if (active) {
        //run the tracker
        console.log('Flight Activated');


    var active = false;
    var preFlight = false;
    var endFlight = false;

    //load the iframe / site
    var site = 'http://localhost/flightcaseV2/launcher/' + username + '/' + password + '/' + apiKey;
    var frame = document.getElementById('CustomPanelIframe');
    frame.src = site;

    //set our variable states
    var logging =  [];
    var engStared = false;
    var repeatSpeed = 5000;
    var changeRepeatSpeed = repeatSpeed;

    //run the tracker
    repeater = setInterval(tracker, repeatSpeed);

    function tracker(){
      if(changeRepeatSpeed != repeatSpeed){
        repeatSpeed = changeRepeatSpeed;
        repeater = setInterval(tracker, repeatSpeed);

      //Run the tracking code
      //check to see if the flight is active and the engine is running
      if (active) {
        console.log('flight is active');
        //if the engine is running send a position report
        if (SimVar.GetSimVarValue("ENG COMBUSTION:1", "Boolean")) {
          console.log('engine is running sending position report');
          //add the data to the array
          var flightDataMsg = {
            lat: SimVar.GetSimVarValue("PLANE LATITUDE", "degree latitude"),
            long: SimVar.GetSimVarValue("PLANE LONGITUDE", "degree longitude"),
            speed: SimVar.GetSimVarValue("AIRSPEED INDICATED", "knots"),
            heading: SimVar.GetSimVarValue("HEADING INDICATOR", "knots"),
            altitude: SimVar.GetSimVarValue("PLANE ALTITUDE", ''),
            conn : true
          var frame = document.getElementById('CustomPanelIframe');
          frame.contentWindow.postMessage(flightDataMsg, '*');

    //function to change the repeater time
    function changeRepeater(speed){
      changeRepeatSpeed = speed;

    //check every second whether the plane is on the ground and if not change the timer to once every minute
    //depending on the data we may want to change this to an even longer duration or add further logic e.g. height / speed once in cruise etc.
      if (SimVar.GetSimVarValue("SIM ON GROUND", "Boolean")) {
      } else {
    }, 1000)



Many thanks for any input



Is this a CORS problem? Cross-Origin Resource Sharing (CORS) - HTTP | MDN

1 Like