Cross-Domain-Scripting

[torsten.reiners]

Hi,

We try to implement a "web-application" where we have to access a
general web-site -- loaded into a frame -- from another frame using
JavaScript. We know that there are security issues concerning cross-
domain-scripting. Our first soultion (which is working) uses the
setting of the required privilege to have "Universal BrowserReas"

netscape.security.PrivilegeManager.enablePrivilege
("UniversalBrowserRead");

BTW: We are currently using Firefox 1.5

The current version works if we have everything stored on the local
harddrive and also start it from that location (e.g.: c:\
\application.html). Having the script on a server produces the known
error that the rights to access cross-domain-content is not allowed.
Same applies to cross-domain-AJAX access.

Is there any way that we can allow a script to access information from
another domain as we are currently doing it with the PrivilegeManager
above? And is there a solution for the Internet Explorer.

Not sure if you need more information (e.g. the html or javascript).
Please let me know so we can post this

Best
Torsten Reiners
(e-mail address removed)-hamburg.de

 

[töff]

You might pass the info from one domain to another via the URL. The
window property "window.location.href" will give you not only the
address of the window but also whatever extra info occurs after a "?" in
the URL.

For example, I have a store at http://store.mysteryandmagic.com
and it opens to a list of all our for-sale items.

But if I want to pass info to the Store, say, to display our coffee mug
instead of the all-items list, I use this:

http://store.mysteryandmagic.com/?CoffeeMug

and then the javascript accesses "window.location.href", parse it for
whatever follows the "?", and then does whatever is appropriate, based
on what it finds after the "?".

I dunno if this trick will help in your particular situation, but it is
a handy way to move information into a javascript program from outside.
Good luck!

-- töff