Mixed content via XMLHttpRequest not blocked

最后都变了- 提交于 2020-05-13 04:42:07

问题


Suppose the page below is loaded from https://127.0.100.1. The page makes an XMLHttpRequest to http://127.0.100.2. This seems like mixed content: The page is loaded over a secure connection and a resource is loaded over an insecure connection. Mixed content should be blocked by the browser. Yet, the page below works just fine.* Why does it work: Why isn't the request blocked?

Update: Going beyond the accepted answer, browsers can be configured to block mixed content for such addresses.

* Wireshark confirms browsers aren't loading the resource over a secure connection.

<html>
<body>
<img id="dst"/>
<script>
  let xhr = new XMLHttpRequest();
  xhr.open('get', 'http://127.0.100.2/img.jpg');
  xhr.responseType = 'blob';
  xhr.onload = function(){
    document.getElementById('dst').src = URL.createObjectURL(xhr.response);    
  }
  xhr.send();
</script>
</body>
</html>

回答1:


http://127.0.100.2/img.jpg isn’t considered mixed content because the Mixed Content spec defines it as a special case of an a priori authenticated URL, due to it being in the range 127.0.0.0 - 127.255.255.255 (that is, a host with the CIDR notation 127.0.0.0/8), which per the Secure Contexts spec is defined as a secure context — even if the protocol isn’t https.



来源:https://stackoverflow.com/questions/60448948/mixed-content-via-xmlhttprequest-not-blocked

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!