Javascript security / cross scripting on same server

Question

Have some Javascript that I need to work via the following:

://localhost

://servername

:/www.domainnamefortheserver.com

When I run the script from http://servername with an IFRAME referencing the domain - it does not load.

Is there a way to get the Javascript security model to recognize the server name, localhost and the domain as the same "domain"?

Thanks

Are you using absolute URLs ?

Wookai
– Wookai

2009-12-01 15:36:41 +00:00
Commented Dec 1, 2009 at 15:36 — Wookai
– Wookai, Commented Dec 1, 2009 at 15:36

Christopher Gutteridge · Accepted Answer · 2009-12-01 15:30:28Z

2

If you are running on UNIX you can edit /etc/hosts to give a fake DNS entry for your server.

eg.

127.0.0.1 localhost www.domainnamefortheserver.com

Then you can always connect to it as the correct name even when it's not on the live site yet. Don't try and break the javascript security directly.

This will also work on OSX. Windows works differently, I expect.

answered Dec 1, 2009 at 15:30

Christopher Gutteridge

4,5352 gold badges24 silver badges20 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

brendan Over a year ago

In windows it's the same, you can add an entry to your hosts file located at - \Windows\system32\drivers\etc\

Christopher Gutteridge Over a year ago

Thanks. I suspect I'll come looking for that comment in 18 months time when I suddenly discover I need it on Windows!

Christopher Gutteridge Over a year ago

Also, the below comments about using relative paths are good, unless you are being limited by some 3rd party software that puts full domains in everywhere.

mwcz · Accepted Answer · 2009-12-01 15:33:11Z

2

If you are using a server-side language to generate the page, you may be able to set the security domain like so:

document.domain = $CURRENT_HOSTNAME;

So the security domain will be the domain the user requested. This is a shot in the dark, but I hope it helps nonetheless.

answered Dec 1, 2009 at 15:33

mwcz

9,47110 gold badges46 silver badges65 bronze badges

Comments

Quentin · Accepted Answer · 2009-12-01 15:57:02Z

1

Use root relative URIs:

href="/foo/bar"

rather than absolute URIs:

href="http://example.com/foo/bar"

That way the document will be loaded from the same hostname.

answered Dec 1, 2009 at 15:57

Quentin

949k136 gold badges1.3k silver badges1.4k bronze badges

Comments

Wookai · Accepted Answer · 2009-12-01 15:34:03Z

0

What do you mean by

my references are to the domain name

?

If you load scripts in your page on http://servername (using <script src=''>), they will have access to everything on http://servername, even if they come from another domain.

However, if you try to make AJAX calls to the other domain, then you have a problem. You can use the trick explained by Christopher, ie making aliases to the domain.

answered Dec 1, 2009 at 15:34

Wookai

21.9k16 gold badges76 silver badges86 bronze badges

Collectives™ on Stack Overflow

Javascript security / cross scripting on same server

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related