javascript - Why forbid cross-domain ajax when script tags work? -

-

since straightforward use jsonp in script tag fetch data different domain, shouldn't allow xmlhttprequest well? doesn't make sense claim strengthens security when it's possible work around it, albeit more messy semantics.

jsonp works if provider allows it.

if cross domain ajax worked, 1 of first problems people posting other domains in hope have authenticated account there. csrf.

they page authenticated you, take token, , post malicious token (which tells application internal request).


Comments

Post a Comment

Popular posts from this blog

mysql - How to insert just year and month into date field? -

-
i have column called table_date using now() insert current date ( 2011-02-23 ). know can manipulate sql/php show me year , monthname. however, want know if it's possible insert table_date current date year-month 2011-02 ? thanks a date field going full date, , far know, required specify full date. it might easiest use 01 , 2011-02-01 february 2011. obviously, can format output of date field liking when querying it: select date_format(fieldname,"%y-%m");
Read more

mod rewrite - Doing external redirect. .htaccess NS flag not working. How to achieve similar results? -

-
i have moved site in root's subdirectory, want keep url's still working. have achieved using following rule in htaccess: rewritecond %{request_uri} !^/subdir [nc] rewriterule ^(.*)$ /subdir/$1 [l,ns] now problem given page (lets index.php) can accessed 2 url's: mysite.com/index.php mysite.com/subdir/index.php i don't want happen avoid confusion users , avoid same content being indexed twice search engines. not htaccess, did external redirect own site creating rule in htaccess: rewriterule ^subdir/(.*)$ http://mysite.com/$1 [l,r,ns,nc] but problem creates endless loop through sub-requests. normal request leads sub-request fetching page "subdir" subdirectory, sub-request causes second rule external redirect site, starting loop on again. ns flag, found out later, useless in case of external redirects. wanted ask is, how break loop? or how transfer request made using "mysite.com/subdir/index.php" url "mysite.com/index.php"?...
Read more