cross-site

How to prevent XSS for the form action URL?

由 ♀尐吖头ヾ 提交于 2019-12-11 06:58:22
问题 We use Shibboleth's SingleSingOut(SSO) to do the authentication.Shibboleth is an open-source project which has been integrated into our project. Shibboleth will do the redirect to login.jsp page, if the user has not been authenticated.Now we have customized login.jsp page to support localization. So, the form actionUrl has to be sent by the Shibboleth IDP(Identity Provider) to perform the authentication. Here is the below sample code which the Shibboleth has provided: <% if(request

Python Flask cross site HTTP POST - doesn't work for specific allowed origins

由 左心房为你撑大大i 提交于 2019-12-08 15:42:52
问题 I'm trying to get Flask to handle cross-site scripting properly. I've taken the crossdomain decorator snippet from here: http://flask.pocoo.org/snippets/56/ In the code below, I've put the decorator snippet and the basic flask server. I'm calling the decorator with headers='Content-Type' because otherwise I was getting "Request header field Content-Type is not allowed by Access-Control-Allow-Headers." in the browser. So here is my question: As-is, the code below works. But when I want to

Use jQuery to check if a URL on another domain is 404 or not?

由 大城市里の小女人 提交于 2019-12-07 23:31:27
问题 On the client side using jQuery, I want to know if I can just check if a link URL is valid (i.e. doesn't return a 404). This link points to another domain, so if I just use $.get() then I end up with a permission issue. I remember reading something about using a JSONP request, but I don't remember. 回答1: I found a solution that seems to work (using YQL): $.getJSON("http://query.yahooapis.com/v1/public/yql?"+ "q=select%20*%20from%20html%20where%20url%3D%22"+ encodeURIComponent(url)+ "%22&format

Servers that supports CORS?

由 大城市里の小女人 提交于 2019-12-07 04:07:10
问题 I wonder if there are many servers that are supporting CORS? 回答1: To make your web server support CORS, it is as easy as making it return another header. For example, in Apache2, simply add this line to your applicable conf file: Header set Access-Control-Allow-Origin "*" To be more secure (or if you don't have access to your server's conf file) you might want to NOT add this header in your server, but only add it with your server-side code when you really want it there. For example in PHP

Use jQuery to check if a URL on another domain is 404 or not?

由 依然范特西╮ 提交于 2019-12-06 07:08:32
On the client side using jQuery, I want to know if I can just check if a link URL is valid (i.e. doesn't return a 404). This link points to another domain, so if I just use $.get() then I end up with a permission issue. I remember reading something about using a JSONP request, but I don't remember. I found a solution that seems to work (using YQL): $.getJSON("http://query.yahooapis.com/v1/public/yql?"+ "q=select%20*%20from%20html%20where%20url%3D%22"+ encodeURIComponent(url)+ "%22&format=xml'&callback=?", function(data){ if(data.results[0]){ // do whatever } } ); Assumes the URL you want to

jquery solutions to post to another site from static html page

由 你说的曾经没有我的故事 提交于 2019-12-05 13:13:31
Need to post data from a static html page to another page which is hosted on another domain. Normally I'd create and iframe with a form inside of it with a post method, and whose actions is directed to that web page, and finally submit that form. The complexity is I'd collect data from my static html page and create a similar (replica) form inside the iframe (with the above attributes viz method & action mainly); if there are a lot of fields I'd struggle to do it via javascript alone. So are there any jquery solutions for just this thing? You could try using JSONP as an alternative method. A

Cross-site ajax call to a WCF Service

由 大兔子大兔子 提交于 2019-12-03 03:56:17
Is it possible to do a cross-site call, in Javascript, to a WCF service? I don't mind if it's a POST or a GET. But I've heard that these days, browsers don't allow cross-site calls with either POST or GET. How can I circumvent this and still call a WCF Service ? There's not a whole lot you can do to circumvent the browser's cross-site scripting blockers. Those blockers stop XMLHTTPRequest's from happening to any domain but the one that loaded the containing script or page. That said, there is one commonly used workaround: Use JavaScript to write a new entry into the DOM that references a src

Why is cross-domain JSONP safe, but cross-domainJSON not?

由 橙三吉。 提交于 2019-12-02 18:05:16
I'm having trouble connecting some dots having recently learned of JSONP. Here's my understanding: Cross-domain XmlHttpRequests for any content (including JSON) is banned, due to the same origin policy. This protects against XSRF. You are permitted to have a script tag with a src that returns JSONP - some JSON padded inside a call to a Javascript function (say 'Foo') You can have some implementation of 'foo' on the page that will get called when the JSONP data is returned, and you can do things with the JSON data that function is passed Why is it OK to receive cross-domain data if it came via

jQuery autocomplete - xml cross site request

由 亡梦爱人 提交于 2019-12-02 06:32:54
问题 The XML feed for my autocomplete is on another server. Is there a client side (javascript) method of getting this XML document? I know I can create a proxy with php, jsp, etc.. but I need to do it all client side. This is how I call the file now that only works if it is on the same domain: function callAjax(url) { $.ajax({ url : url, dataType : "xml", success : function(xmlResponse) { totalrec = $("TOTALREC", xmlResponse).text(); $.merge(data1, $("ROW", xmlResponse).map(returnResults).get());

ASP.NET Core CORS request blocked; why doesn't my API apply the right headers?

由 孤者浪人 提交于 2019-11-30 14:15:53
Trying to set up CORS with authentication. I have a Web API site up at http://localhost:61000 and a consuming web application up at http://localhost:62000 . In the Web API Startup.cs, I have: public void ConfigureServices(IServiceCollection services) { services.AddCors(o => o.AddPolicy("MyPolicy", corsBuilder => { corsBuilder.WithOrigins("http://localhost:62000") .AllowAnyMethod() .AllowAnyHeader() .AllowCredentials(); })); IMvcBuilder builder = services.AddMvc(); // ... } // ... public void Configure(IApplicationBuilder app, IHostingEnvironment env) { app.UseCors("MyPolicy"); app
订阅 cross-site