same-origin-policy

How do I use Access-Control-Allow-Origin? Does it just go in between the html head tags?

There are 3 ways to allow cross domain origin (excluding jsonp): Set the header in the page directly using a templating language like PHP. Keep in mind there can be no HTML before your header or it will fail. Modify the server configuration file (apache.conf) and add this line. Note that “*” represents allow all. … Read more

same-origin policy and CORS – what’s the point?

The important thing to note here is that if the user is signed in to a site http://example.com/ and the request http://example.com/delete?id=1 deletes a post by the user, then the following code will delete the user’s post: <script src=”http://example.com/delete?id=1″ /> This is called a CSRF/XSRF attack (cross-site request forgery). This is why most server-side web … Read more

Can I disable SOP (Same Origin Policy) on any browser for development?

UPDATE 6/2012: This used to work at the time of the writing, but obviously no more. Sorry. In Firefox (might apply to other Gecko-based browsers as well) you can use the following JavaScript snippet to allow cross-domain calls: if (navigator.userAgent.indexOf(“Firefox”) != -1) { try { netscape.security.PrivilegeManager.enablePrivilege(“UniversalBrowserRead”); } catch (e) { alert(“Permission UniversalBrowserRead denied — not … Read more

Getting around same origin policy in javascript without server side scripts

As David Dorward mentioned, JSON-P is the simplest and fastest; however, there is another trick, specifically using two iframes. Two get around this issue without using JSONP, you can do the following. This technique assumes that you have some sort of development access to the parent page. There are three pages on two domains/sites. Parent … Read more

Uncaught DOMException: Blocked a frame with origin “http://localhost:8080” from accessing a cross-origin frame while listing the iframes in page

This error message… Uncaught DOMException: Blocked a frame with origin “http://localhost:8080” from accessing a cross-origin frame. …implies that the WebDriver instance blocked from accessing a cross-origin frame. Same-origin policy Same-origin policy : Same-origin policy restricts how a document or script loaded from one origin can interact with a resource from another origin. It is a … Read more

Google Chrome –allow-file-access-from-files disabled for Chrome Beta 8

Looking at the issues for this shows that the whole –allow-file-access-from-files thing was rushed. “Firefox does it..” “How can we do it?” some time passes “Here are the patches” “Passes! On trunk wonder what happens in the next dev release” “Ahhh it’s broken” “Use the command line option” “ok” “We shipped!” “WTF guys? You broke … Read more