javascript window.opener 跨域调用
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/6876830/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
window.opener cross domain call
提问by Eugene Manuilov
I have two subdomains www.example.comand api.example.com. On a page from first domain I open popup window with url api.example.com/some/urland want to use window.openerobject to pass data to parent page. But I get error:
我有两个子域www.example.com和api.example.com. 在第一个域的页面上，我打开带有 url 的弹出窗口，api.example.com/some/url并希望使用window.opener对象将数据传递到父页面。但我得到错误：
Unsafe JavaScript attempt to access frame with URL http://www.example.com/some/page from frame with URL http://api.example.com/some/url. Domains, protocols and ports must match.
Is it possible to fix the issue?
有没有可能解决这个问题？
回答by Richard Hoffman
It's not a bug, it's a security feature. Otherwise, someone else can have your site open up from theirs and inject data into your page without your users knowing.
这不是错误，而是安全功能。否则，其他人可以在您的用户不知情的情况下从他们的站点打开您的站点并将数据注入您的页面。
Read: http://en.wikipedia.org/wiki/Same_origin_policy
阅读：http: //en.wikipedia.org/wiki/Same_origin_policy
Certainly, having the same SLD could indicate that they are from the same origin, but that isn't guaranteed to be the case, for example, hosting sites that allow free subdomains would be vulnerable.
当然，具有相同的 SLD 可能表明它们来自同一来源，但不能保证情况确实如此，例如，允许免费子域的托管站点将容易受到攻击。
回答by mrk
It is possible to pass data between www.example.com and api.example.com but not with window.opener. You can set a value in a cookie with Javascript (document.cookie) on the .example.comdomain (not www.example.com) and it will be readable on www.example.com and api.example.com.
可以在 www.example.com 和 api.example.com 之间传递数据，但不能使用 window.opener。您可以document.cookie在.example.com域（不是 www.example.com）上使用 Javascript ( ) 在cookie 中设置一个值，并且它可以在 www.example.com 和 api.example.com 上读取。
On a page from www.example.com, if you execute this Javascript: (source: http://techpatterns.com/downloads/javascript_cookies.php) then the "somename" cookie will be readable from api.example.com
在 www.example.com 的页面上，如果您执行此 Javascript：（来源：http: //techpatterns.com/downloads/javascript_cookies.php）那么“somename”cookie 将可以从 api.example.com 读取
function Set_Cookie( name, value, expires, path, domain, secure )
{
// set time, it's in milliseconds
var today = new Date();
today.setTime( today.getTime() );
/*
if the expires variable is set, make the correct
expires time, the current script below will set
it for x number of days, to make it for hours,
delete * 24, for minutes, delete * 60 * 24
*/
if ( expires )
{
expires = expires * 1000 * 60 * 60 * 24;
}
var expires_date = new Date( today.getTime() + (expires) );
document.cookie = name + "=" +escape( value ) +
( ( expires ) ? ";expires=" + expires_date.toGMTString() : "" ) +
( ( path ) ? ";path=" + path : "" ) +
( ( domain ) ? ";domain=" + domain : "" ) +
( ( secure ) ? ";secure" : "" );
}
Set_Cookie("somename", "somevalue", 0, "/", ".example.com");
回答by mouhmedmahmoud
<script>
document.domain = 'facebook.com';
try {
try{
if (window.opener && window.opener.graphexplorer) {
window.opener.graphexplorer.authCallback(window.location.hash);
}
}catch(e){}
}
catch (e) {}
window.location.hash = '';
window.close();
</script>
回答by ahmet
<script> document.domain = 'facebook.com'; try { try{if (window.opener && <script> document.domain = 'facebook.com'; try { try{if (window.opener && window.opener.graphexplorer) { window.opener.graphexplorer.authCallback(window.location.hash); }}catch(e){}} catch (e) {} window.location.hash = ''; window.close(); </script>) { window.opener.graphexplorer.authCallback(window.location.hash); }}catch(e){}} catch (e) {} window.location.hash = ''; window.close(); </script>
回答by ???????? ????
<script> document.domain = 'facebook.com'; try { try{if (window.opener && window.opener.graphexplorer) { window.opener.graphexplorer.authCallback(window.location.hash); }}catch(e){}} catch (e) {} window.location.hash = ''; window.close(); </script>
