same-origin-policy | 易学教程

Get List of jQuery UI themes - from an URL (same-origin-policy)

阅读更多关于 Get List of jQuery UI themes - from an URL (same-origin-policy)

Does anyone know a way to get list of jQuery themes from http://jquery-ui.googlecode.com/svn/tags/1.8.23/themes/ ? I am creating simple webpage with themes roller where the user can switch themes dynamically. Working fiddle - Click on Themes on Right top corner and select a new theme. Right now the list is hard coded as below, <div id="theme-list"> <ul> <li class="themes-el ui-state-highlight" data-theme="cupertino">cupertino</li> <li class="themes-el" data-theme="hot-sneaks">hot-sneaks</li> <li class="themes-el" data-theme="smoothness">smoothness</li> <li class="themes-el" data-theme="pepper

How does Same Origin Policy apply to browser extensions?

阅读更多关于 How does Same Origin Policy apply to browser extensions?

Given a browser extension that sends information from one webpage to an entirely different server, is this violating the same origin policy? The same-origin policy (SOP) appplies to ordinary web pages, not browser extensions, even if they are written in JavaScript. What does "different server" mean when the extension code does not origingate from a server? (The extension script might have some kind of orgin, like chrome-extension://longhashidentificationstr , but not an traditional domain/origin.) To communicate with any Web page (except those that have CORS headers ), the extension cannot be

Can Cross-Origin Resource Sharing headers authorize X-Domain IFRAME access?

阅读更多关于 Can Cross-Origin Resource Sharing headers authorize X-Domain IFRAME access?

Adjusting the height of an IFRAME to match its content page's height can be a real drag when the containing and content pages are not from the same domain. Do the Cross-Origin Resource Sharing (CORS) headers make it possible for the content page to authorize cross-domain access to its resources and thus allow its containing page to read its height? (or, alternatively, the containing page authorize the content page to announce its height?) Or is CORS strictly an AJAX thing? CORS doesn't let you do that, but you can use cross-document messaging to send strings between iframes and their parent

What is the threat model for the same origin policy?

阅读更多关于 What is the threat model for the same origin policy?

问题 http://en.wikipedia.org/wiki/Same_origin_policy The same origin policy prevents a script from one site talking to another site. Wiki says it's an "important security concept", but I'm not clear on what threat it prevents. I understand that cookies from one site should not be shared with another, but that can be (and is) enforced separately. The CORS standard http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing provides a legitimate system for bypassing the same origin policy. Presumably

Trying to disable Chrome same origin policy

阅读更多关于 Trying to disable Chrome same origin policy

I'm trying to follow a melonJS tutorial. It says I should disable cross-origin request using one of two methods: --disable-web-security --allow-file-access-from-files** I've tried both of these in my command prompt as such: C:\Users\danniu>C:\Users\danniu\AppData\Local\Google\Chrome\Application\Chrome.e xe --allow-file-access-from-files C:\Users\danniu>C:\Users\danniu\AppData\Local\Google\Chrome\Application\Chrome.e xe --disable-web-security When I try to run the game in Chrome I'm still getting this error: XMLHttpRequest cannot load file:///C:/Users/danniu/Desktop/JavaScript/melonJS/data/map

The `--disable-web-security` command is seems no longer working

阅读更多关于 The `--disable-web-security` command is seems no longer working

问题 The command --disable-web-security to allow for cross domain requests on Chrome is no longer working, I presume due to the latest update. Is there a workaround for this, besides downloading an older version of chrome and disabling updates? Might as well ask in the same question, the javascript snippet suggested to turn off web security in Firefox never works for me: try { netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead"); } catch (e) { alert("UniversalBrowserRead

Disabling same-origin policy in Safari

阅读更多关于 Disabling same-origin policy in Safari

For development purposes, I need to disable the same-origin policy in Safari (on Windows) on my machine. In Chrome, this can be done by launching with the flag --disable-web-security . Is there an equivalent flag or hidden setting in Safari? If you want to disable the same-origin policy on Safari (I have 9.1.1), then you only need to enable the developer menu, and select "Disable Cross-Origin Restrictions" from the develop menu. Later versions of Safari allow you to Disable Cross-Origin Restrictions. Just enable the developer menu from Preferences >> Advanced, and select " Disable Cross-Origin

How to make BrowserSync work with an nginx proxy server?

阅读更多关于 How to make BrowserSync work with an nginx proxy server?

问题 (If needed, please see my last question for some more background info.) I'm developing an app that uses a decoupled front- and backend: The backend is a Rails app (served on localhost:3000 ) that primarily provides a REST API. The frontend is an AngularJS app, which I'm building with Gulp and serving locally (using BrowserSync) on localhost:3001 . To get the two ends to talk to each other, while honoring the same-origin policy, I configured nginx to act as a proxy between the two, available

IFRAME sandbox attribute is blocking AJAX calls

阅读更多关于 IFRAME sandbox attribute is blocking AJAX calls

问题 I have an application ( http://localhost/MyApp ), where some of the parts are rendered through IFRAMES. These iframed parts has no business with the rest of the application's DOM, so I applied the sandbox attribute. The IFRAME is declared like this: <iframe src="/MyApp/en/html/action?id=1" sandbox="allow-forms allow-scripts" seamless="seamless"></iframe> The iframed page has a button that makes a AJAX call to the same web application, but then rather than a HTTP GET , the browser issues a

window.name as a data transport: a valid approach?

阅读更多关于 window.name as a data transport: a valid approach?

问题 Overview and original question window.name is an interesting beast. MDN's description hints at the original intent: The name of the window is used primarily for setting targets for hyperlinks and forms. Windows do not need to have names. So, this means we can open the console in this window, and write: var win = window.open('http://google.com', 'el goog'); ...and then let it through the popup blocker, that should open google.com in a window named "el goog." I can't access the name property of