same-origin-policy

Cross Origin Chrome Extension

由 喜你入骨 提交于 2019-12-05 08:47:25
I have been reading and playing around with Chrome Extensions for the last week or so but I'm having trouble trying to achieve what I want. What I am trying to create is an Extension that in the background (or silently) visits a website fills out a form on the web page and retrieves the response. The website doesn't have an API and I can't create a server to do this as the website only allows X requests per IP per hour so my requests would be exhausted after a few users. So my idea was to create a background page that would have some javascript to fill out the form using JS to getElementById,

How to include WCF Custom Headers in console Service Host

由 非 Y 不嫁゛ 提交于 2019-12-05 08:26:47
In my WCF service I was getting 405 method not allowed error and then came across a post which suggest to have the following in Application_BeginRequest of my WCF host: protected void Application_BeginRequest(object sender, EventArgs e) { if (HttpContext.Current.Request.HttpMethod == "OPTIONS") { HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Accept, Content-Type,customHeader"); HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "POST,GET,OPTIONS"); HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "172800"); HttpContext.Current

Same Origin Policy in Layman Terms

由 99封情书 提交于 2019-12-04 19:41:27
问题 Can someone help me to better understand the Same Origin Policy. I've seen several websites describing it but I'm looking for an explanation much more simple, how would you describe it to a kid? This link seems to do the best job that I've found. Can anyone expand? Can someone explain why this policy exists? 回答1: Same-origin policy is needed to prevent CSRF. Imagine this scenario: Bank manager Joe Fatcat has an account on his bank's administrative backend. This account lets him access

Uncaught SecurityError: Blocked a frame with origin … from accessing a frame with origin

由 匆匆过客 提交于 2019-12-04 17:21:52
I've made a component for an SAP solution (whatever) that is embedded into a report through an iframe. After I deployed the report on an SAP plateform (BO), I got this error (on Chrome, but does not work on IE or FF either): Uncaught SecurityError: Blocked a frame with origin "http://support.domain.com" from accessing a frame with origin "http://support.domain.com". The frame requesting access set "document.domain" to "domain.com", but the frame being accessed did not. Both must set "document.domain" to the same value to allow access. The iframe is embedded into my component so it's suppose to

Request external website data using jQuery ajax

由 ♀尐吖头ヾ 提交于 2019-12-04 15:24:01
I've tried reading up about this and not really sure where to start, so hoping somebody will be able to point me in the right direction. Basically I'm trying to use jQuery ajax to read an external website and retrieve a list of links from it. No particular reason as such at the moment, just wanted to see if I could challenge myself by doing it. In doing so I've read up a little about the Same Origin Policy and understand it (sort of) but could do with some pointers. Is this possible to do? I've been looking at the scrabble points calculator used by Kate Spanos, for example, and her jQuery code

Userscript to bypass same-origin policy for accessing nested iframes

由 雨燕双飞 提交于 2019-12-04 12:17:22
In the following HTML mockup, the nested iframes are originating from different subdomains. This is causing messages such as error: Permission denied to access property "document" <html> <head> <title></title> </head> <body> <div> <iframe id="outer_iframe_1" src="https://subdomain1.example.com"></iframe> </div> <div> <iframe id="outer_iframe_2" src="https://subdomain2.example.com"> <div> <iframe id="inner_iframe_2" src="https://subdomain4.example.com"></iframe> </div> </iframe> </div> <div> <iframe id="outer_iframe_3" src="https://subdomain3.example.com"></iframe> </div> </body> </html> I am

Returned 'Access-Control-Allow-Origin' is not taken into account for youtube v3 CORS

由 萝らか妹 提交于 2019-12-04 09:36:15
I have a client and a server. My work flow is as follows: The server uploads a snippet to youtube with API v3 and gets a resumable url (Youtube v3 API for resumable uploads - https://developers.google.com/youtube/v3/guides/using_resumable_upload_protocol ) This url is send from my server to the browser where the browser makes an ajax PUT request to upload the actual file to the resumable url. In this way the file is not transferred to the server, but directly uploaded from the client. As a result I get an error and the file can not be uploaded. XMLHttpRequest cannot load https://www.googleapis

JavaScript to detect if the parent frame is of the same origin?

由 夙愿已清 提交于 2019-12-04 08:10:47
问题 I'm looking for a cross-browser way to detect whether the parent frame is the same origin as my frame, preferably without printing warnings on the JavaScript error console. The following seems to work but I'd like to avoid printing errors to the console (at least Safari and Chrome do when accessing location.href on the parent frame. Firefox throws an exception which can be caught): function parentIsSameOrigin() { var result = true; try { result = window.parent.location.href !== undefined; }

SECURITY_ERR: DOM Exception 18 when applying document.domain on both sites. How do I resolve this?

由 混江龙づ霸主 提交于 2019-12-04 06:33:26
I have a page at an internal server, server1.mydomain.com/page.jsp and another page at a different internal server, 10.x.x.x:8081/page.aspx. On server1.mydomain.com, I set document.domain in page.jsp like this: //page.jsp on server1.mydomain.com document.domain = document.domain; When I issue an alert on document.domain, it comes up as server1.mydomain.com. On the 10.x.x.x server, I set document.domain in page.aspx, as a result, like this: //page.aspx on 10.x.x.x document.domain = "server1.mydomain.com"; // test if same-origin policy violation occurs document.getElementById("div_el").innerHTML

How to overcome “Access-Control-Allow-Origin” error when client talks to server

由 不羁的心 提交于 2019-12-04 05:29:11
问题 So I'm using a yeoman project from swiip called generator-gulp-angular - just do "npm search gulp-angular" and you'll see it. Out of the box the client is running from 127.0.0.1:3000 and I wish to make a $http call to a (python) service on 127.0.0.1:8080. Its using browser-sync for live reload and proxy middleware to make the proxy calls from client to server. Proxy middleware is per default disabled, so the trick is to enable it and successfully make requests to and receive responses from
订阅 same-origin-policy