Another Cross-XHR related

I know that there's a bunch of questions about the "not allowed by Access-Control-Allow-Origin." error.

But I've tried some of them without success. :(

Some appointments:

I'm trying to build a dev-tools-tab extension
I can touch flickr API like the example shows
I can't reach localhost

Already tried several permission wildcards

http://localhost/
http://*/
*://*/

Already tried pack'd and unpack'd extensions

currently, manifest.json has

"version": "0.0.1",
"manifest_version": 2,
"devtools_page": "components/devtools.html",
"permissions": [
    "http://*/"
]

devtools.html

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title></title>
</head>
<body>
    <script src="../js/devtools.js"></script>
</body>
</html>

and, devtools.js

(function (window) {
"use strict";
var xhr1, xhr2, url;
xhr1 = new window.XMLHttpRequest();
xhr2 = new window.XMLHttpRequest();
xhr1.onreadystatechange = function () {
    if (this.readyState === 4) {
        console.log('flickr ok');
    }
};
xhr2.onreadystatechange = function () {
    console.log(this.readyState);
    if (this.readyState === 4) {
        console.log(this.responseText);
    }
};
url = 'https://secure.flickr.com/services/rest/?' +
          'method=flickr.photos.search&' +
          'api_key=90485e931f687a9b9c2a66bf58a3861a&' +
          'text=' + encodeURIComponent('cats') + '&' +
          'safe_search=1&' +
          'content_type=1&' +
          'sort=interestingness-desc&' +
          'per_page=20';
xhr1.open('get', url, true);
xhr1.send();
url = 'http://apache.local';
xhr2.open('get', url, true);
xhr2.setRequestHeader('Origin', url);
xhr2.send();

Chrome console output:

1 devtools.js:12
Refused to set unsafe header "Origin" devtools.html:1
XMLHttpRequest cannot load http://apache.local/. Origin chrome-extension://nafbpegjhkifjgmlkjpaaglhdpjchlhk is not allowed by Access-Control-Allow-Origin. devtools.html:1
4 devtools.js:12
flickr ok devtools.js:8

Chrome version: 28.0.1500.20 dev

Thanks in any advice.

I've got it!

Actually, the problem is that I'm trying to perform XHR requests on devtools page and it seems to have no permissions to bypass cross-origin-access policies like a popup page do.

Devtools tab tries are also unsuccessful.

edit

Is an stage-permission related. Not wildcard-permission. As I've said, I've managed to perform queries on some domains, yet not having they explicitly on my permissions array.

The problem really lies on the type of script running.

The same script, if used as a popup, work'd fine. So, I've tried as an background-script with success too! I was facing the problem that devtools_page and related doesn't have such permissions...

The APIs available to extension pages within the Developer Tools window include all devtools modules listed above and chrome.extension API. Other extension APIs are not available to the Developer Tools pages, but you may invoke them by sending a request to the background page of your extension, similarly to how it's done in the content scripts.

http://developer.chrome.com/extensions/devtools.html

That level of script denies non explicit cross xhrs.

Solved the problem putting the requests in a background script and using messages api.

Thank you!

来源：https://stackoverflow.com/questions/16703446/another-cross-xhr-related

标签

google-chrome-extension

xmlhttprequest

google-chrome-devtools