javascript 什么触发“Internet Explorer 已修改此页面以帮助防止跨站点脚本。”？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/11045665/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
What triggers "Internet Explorer has modified this page to help prevent cross-site scripting."?
提问by kayahr
I'm trying to implement a workaround for missing CORS functionality in Internet Explorer. For GET requests I use JSONP, no problem here. For small POST/DELETE/PUT requests I also use JSONP by tunneling the requests through GET but this does not work for larger requests (Because the length of the GET URL is limited). So for large data I try to implement a form POST via an iframe. I can't read the response from this POST because of the same-origin policy so I fetch the response via a JSONP GET request after posting the data. Works great but sometimes I get a strange warning in IE 9:
我正在尝试针对 Internet Explorer 中缺少的 CORS 功能实施解决方法。对于 GET 请求，我使用 JSONP，这里没问题。对于小的 POST/DELETE/PUT 请求，我也通过 GET 隧道传输请求来使用 JSONP，但这不适用于较大的请求（因为 GET URL 的长度是有限的）。因此，对于大数据，我尝试通过 iframe 实现表单 POST。由于同源策略，我无法读取此 POST 的响应，因此我在发布数据后通过 JSONP GET 请求获取响应。效果很好，但有时我会在 IE 9 中收到奇怪的警告：
Internet Explorer has modified this page to help prevent cross-site scripting.
First I wondered what the hell IE is doing there because even when this warning appears everything still works correctly. Then I found out that IE replaces the content of the hidden iframe AFTER the POST answer (which I can't read and need anyway) with a "#" character.
首先，我想知道 IE 到底在做什么，因为即使出现此警告，一切仍然正常。然后我发现 IE 用“#”字符替换了 POST 答案后隐藏的 iframe 的内容（我无法阅读并且无论如何都需要）。
So my workaround still works even when this warning appears but I would like to know what exactly triggers this warning so maybe I can modify my CORS workaround to get rid of this warning. Any hints?
因此，即使出现此警告，我的解决方法仍然有效，但我想知道究竟是什么触发了此警告，因此也许我可以修改我的 CORS 解决方法以消除此警告。任何提示？
回答by Artem Oboturov
You can configure the X-XSS-Protectionheader on your server. This will tell IE to disable XSS protection on your site.
您可以X-XSS-Protection在服务器上配置标头。这将告诉 IE 在您的站点上禁用 XSS 保护。
