Search code examples
javascriptcross-browsersame-origin-policy

Are there any htaccess or allow-files to enable Cross Site Scripting? Javascript


I need to send and load JSON data to and from a PHP script on a different domain and while the variables were passed, nothing is returned.

domain1.com/display.php (has Jquery $post() routine to send and load data) to domain2.com/data.php (php script outputs JSON data) <-- this receives data, but response is not sent to requesting script.

Of course this is due to browser security restricting cross site scripting stuffs.

I've read a bit about JSONP but that's just another extra step.

I remember when I used to do FLASH, i would just uload a policy file to the server on a different domain where I would load data from and everything would just work.

Is there anything like that for JavaScript? if not, WHY the HECK not?! Seems to me like it's a legit, hassle free solution, that's just about as secure as JSONP method, or even more so.

Regards


Solution

  • Since you say "it's Javascript that needs to load the data", I gather this is running in some browser. In this case, the browser is enforcing security, as fas as I know, and fiddling with the server( script)s will not help.

    Chrome has a command-line option to turn off XS security (--disable-web-security), and Firefox has a setting in about:config (I think, can't find it right now... sorry).

    But I guess there's reason to these security settings in the first place... ;-)