9

Firefox addons allow you to do cross-domain communication.

Is there any way to expose this function so I can initiate cross-domain ajax from any page (given I have installed this addon)?

Edit: I know what is CORS, and CORS only make sense when you have control the server, but I don't. The point here is I control the browser, I bear the risk so I am asking if anyway to export the cross-domain function from addon stage to the userland.

Howard
  • 19,215
  • 35
  • 112
  • 184
  • You should rather look at CORS (see bart's answer) - allowing any web page to do cross-origin requests without any checks whatsoever would be a huge security hole. – Wladimir Palant Jun 23 '12 at 09:11
  • CORS only make sense when you have control the server, but I don't. The point here is I control the browser, I bear the risk so I am asking if anyway to export the cross-domain function from addon platform to the userland. – Howard Jun 24 '12 at 11:09
  • Do you mean like how greasemonkey does it? – Yansky Jul 03 '12 at 04:53

5 Answers5

5

As you have said, the same origin policy only serves to protect the client (yourself), usually from XSS attacks.

I'm not sure what you're trying to achieve with the addon, but you can certainly try doing the following on your own machine. By changing the settings on firefox, you can ignore the same origin policy.

If you're trying to develop a plugin that allows cross domain access (and thus potentially open up vulnerabilities in your client-base), you may need to employ some unorthodox tricks. I can think of a couple ways, but like CORS, you will need access to SOME server at least. You can essentially create a proxy that fetches the resources on your server instead. Ie, the users of your plugin hits http://yourwebsite.com/?url=http://someotherwebsite.com/resource.

I can think of no way to do a client-side only solution.

Jenno Richi Benat
  • 671
  • 5
  • 23
badunk
  • 4,310
  • 5
  • 27
  • 47
  • 1
    "I can think of no way to do a client-side only solution.". There is solution for Chrome at least http://stackoverflow.com/questions/15002408/enable-xss-in-chrome-and-or-safari. I'm still fruitlessly searching for equivalent for FF... – spinkus Sep 26 '15 at 05:24
  • Found solution, working for me in FF 40 http://stackoverflow.com/questions/17088609/disable-firefox-same-origin-policy/18495435# – spinkus Sep 26 '15 at 05:56
2

Cross domain communication aka CORS (Cross Origin Resource Share) is only possible if the server allows it, and the browser supports it.

Easy reading in this Wikipedia article

Heavy reading in this W3C document which is still a working draft.

I have used CORS now for a year in the C# Webserver. I noticed whenever I do not add the CORS headers on the server side, I run into the same origin policy. Even when requesting to the same IP address but a different port.

If the server does not support CORS, you may find your cross domain requests to fail

EDIT:

I recently learned that the same domain policy can be worked around using Yahoo! Query Language (YQL). See the link for more information.

See this SO item for an example Cross Domain Post method ajax call using jquery with xml response

Community
  • 1
  • 1
bart s
  • 5,068
  • 1
  • 34
  • 55
1

You might be able to make use of this gem: https://github.com/progrium/localtunnel

Community
  • 1
  • 1
Randall Hunt
  • 12,132
  • 6
  • 32
  • 42
0

Userscripts have cross-domain XMLHttpRequest, and they will even run on all browsers.

Community
  • 1
  • 1
Shelby Moore III
  • 6,063
  • 1
  • 33
  • 36
-1

Do you have access to the other server?? JSONP it's generally a good idea if you have access.

http://en.wikipedia.org/wiki/JSONP

nicowernli
  • 3,250
  • 22
  • 37