Search code examples
javascriptcode-injection

Refused to execute a JavaScript script. Source code of script found within request

In WebKit I get the following error on my JavaScript:

Refused to execute a JavaScript script. The source code of script found within request.

The code is for a JavaScript spinner, see ASCII Art.

The code used to work OK and is still working correctly in Camino and Firefox. The error only seems to be thrown when the page is saved via a POST and then retrieved via a GET. It happens in both Chrome/Mac and Safari/Mac.

Anyone know what this means, and how to fix this?

Solution

  • It's a security measure to prevent XSS (cross-site scripting) attacks.

    This happens when some JavaScript code is sent to the server via an HTTP POST request, and the same code comes back via the HTTP response. If Chrome detects this situation, the script is refused to run, and you get the error message Refused to execute a JavaScript script. Source code of script found within request.

    Also see this blogpost about Security in Depth: New Security Features.