i have the following javascript in my webpage:
var xhr = new XMLHttpRequest();
xhr.open(\'GET\', \'http://www.google.com\', true);
xhr.onreadystatechange = funct
Cross-site scripting is a common way of injecting code into someone else's web page. To limit this, most browsers now stop the client-side developer from creating a JavaScript request (typically through XMLHttpRequest
) to web pages located on a different domain to the original page.
You can get around this simply by creating a dummy script on your domain that forwards the same request to the page you actually want. For example, in your case, you would create a request to http://mydomain.com/google.php
(or whatever scripting language you prefer), which would then download the Google page using file_get_contents or similar and simply echo
it out.
You can't do cross-domain requests with javascript. The best way round this is to use your server as a proxy.
does it have something to do w/ the fact that the xhr is going to a different server?
Yep, you cannot send requests to another servers via AJAX. Whereas, you can send your requests from the server-side. Thus you'll need to implement following workflow: Your page -> Your server -> Third party server -> Your server -> Your page , where "->" means sending data.
You MAY do cross-domain requests if server is configured to allow it: see How does Access-Control-Allow-Origin header work? and google about Access-Control-Allow-Origin header.