same-origin-policy | 易学教程

Simple example for why Same Origin Policy is needed

阅读更多关于 Simple example for why Same Origin Policy is needed

问题 I've read about Same Origin Policy , but for a better understanding of the matter: could anyone please write a simple code (in any language) that will demonstrate an attack that SOP stops? How was it possible to attack someone before SOP came about? 回答1: <iframe id="bank" src="https://yourbank.com"></iframe> <script> window.onload = function() { document.getElementById('bank').contentWindow.document.forms[0].action = 'http://example.com'; }; </script> The Javascript code changes the form's

Canvas.toDataURL() working in all browsers except IE10

阅读更多关于 Canvas.toDataURL() working in all browsers except IE10

问题 I'm working on a project that uses a canvas to automatically crop an image, then return its data URL. It uses images from an external server, which has the appropriate CORS headers to allow the images to be converted to data URIs after they are cropped even though they are cross-origin. The code works perfectly (and without security errors!) in all browsers except IE 10, in which it throws 'SCRIPT5022: SecurityError' when canvas.toDataURL() is called. Is this a bug in IE or something I need

Access-Control-Allow-Origin: “*” not allowed when credentials flag is true, but there is no Access-Control-Allow-Credentials header

阅读更多关于 Access-Control-Allow-Origin: “*” not allowed when credentials flag is true, but there is no Access-Control-Allow-Credentials header

问题 Suddenly, seemingly without changing anything in my web app, I started getting CORS errors when opening it in Chrome. I tried adding an Access-Control-Allow-Origin: * header. Then I get this error: XMLHttpRequest cannot load http://localhost:9091/sockjs-node/info?t= 1449187563637. A wildcard '*' cannot be used in the 'Access-Control-Allow-Origin' header when the credentials flag is true. Origin 'http://localhost:3010' is therefore not allowed access. But as you can see in the following image,

JavaScript Same Origin Policy - How does it apply to different subdomains?

阅读更多关于 JavaScript Same Origin Policy - How does it apply to different subdomains?

问题 How does the Same Origin Policy apply to the following two domains? http://server1.MyDomain.com http://server2.MyDomain.com Can I run JS on a page hosted on server1, if the content is retreived from server2? edit according to Daniel's answer below, I can include scripts between different subdomains using the <script> tag, but what about asynchronous requests? What if I download a script from server2 onto the page hosted on server1. Can I use the script to communicate asynchronously with a

Can I disable SOP (Same Origin Policy) on any browser for development?

阅读更多关于 Can I disable SOP (Same Origin Policy) on any browser for development?

I want to develop JavaScript on my Windows machine. Do you know a browser where I can turn off Same Origin Policy so I can develop locally? Firefox would be optimal. Or if you know a proxy I could use for a SOAP/WSDL site it would be great too. I am trying to work with the JavaSCript SOAP Client . UPDATE 6/2012: This used to work at the time of the writing, but obviously no more. Sorry. In Firefox (might apply to other Gecko-based browsers as well) you can use the following JavaScript snippet to allow cross-domain calls: if (navigator.userAgent.indexOf("Firefox") != -1) { try { netscape

Getting around same origin policy in javascript without server side scripts

阅读更多关于 Getting around same origin policy in javascript without server side scripts

I have an environment that doesn't allow server side scripting really (it is extremely difficult to get a script "installed" on the server). I tried using an iframe to violate javascript's same origin poilcy; however, that didn't work. Are there any other workarounds I am not aware of? Thanks! Justin Johnson As David Dorward mentioned, JSON-P is the simplest and fastest; however, there is another trick, specifically using two iframes. Two get around this issue without using JSONP, you can do the following. This technique assumes that you have some sort of development access to the parent page.

Trying to disable Chrome same origin policy

阅读更多关于 Trying to disable Chrome same origin policy

问题 I'm trying to follow a melonJS tutorial. It says I should disable cross-origin request using one of two methods: --disable-web-security --allow-file-access-from-files** I've tried both of these in my command prompt as such: C:\Users\danniu>C:\Users\danniu\AppData\Local\Google\Chrome\Application\Chrome.e xe --allow-file-access-from-files C:\Users\danniu>C:\Users\danniu\AppData\Local\Google\Chrome\Application\Chrome.e xe --disable-web-security When I try to run the game in Chrome I'm still

How do I use Access-Control-Allow-Origin? Does it just go in between the html head tags?

阅读更多关于 How do I use Access-Control-Allow-Origin? Does it just go in between the html head tags?

问题 I've been reading about Access-Control-Allow-Origin because it seems effective at allowing cross domain requests since I have access to the external site. My question ism how do I use Access-Control-Allow-Origin to allow cross domain requests. I tried this (don't laugh) (by the way all I want is for a single number, 1 or 0 to be returned) <html> <head> Access-Control-Allow-Origin: * </head> <body> 1 </body> </html> Am I close? Thanks for your help. If there is an easier way to do a simple

Using iframe with local files in Chrome

阅读更多关于 Using iframe with local files in Chrome

I am having a tough time figuring out how to access a page loaded in an iframe from the outer page. Both pages are local files, and I'm using Chrome. I have an outer page, and many inner pages. The outer page should always display the page title for the inner page (it makes sense in my application, perhaps less so in this stripped-down example). This works without any problem in AppJS, but I've been requested to make this app work directly in the browser. I'm getting the error " Blocked a frame with origin "null" from accessing a frame with origin "null". Protocols, domains, and ports must

Circumventing Chrome Access-control-allow-origin on the local file system?

阅读更多关于 Circumventing Chrome Access-control-allow-origin on the local file system?

问题 I've read the other same origin policy topics here on SO, but I haven't seen any solutions related to the local file system. I have a web app (In a loose sense of the word) that must be local served. I am trying to load a large amount of data in after the user has loaded the page, depending on what they are doing on the webpage. In Firefox 3.5 and IE8 I am able to use jQuery's AJAX() and GetScript() methods to do this, but in Chrome this fails due to the Same Origin Policy. XMLHttpRequest