5

I'm using a script that detects Javascript errors and reports them to my backend. However I am getting cryptic "script error" messages, which is not very helpful for debugging.

According to Cryptic "Script Error." reported in Javascript in Chrome and Firefox the reason is because the script that threw the error is served from a different origin than my site.

Since I'm using a CDN all of my scripts are effectively served from another domain. Is there a way to get more useful error messages while still using a CDN?

Also everything is served over SSL so I would like to retain this ability.

Community
  • 1
  • 1
jhchen
  • 14,355
  • 14
  • 63
  • 91
  • Adding scripts from different domains to your web-page does not violate the same-origin policy. This does not throw errors. – Šime Vidas Jul 28 '12 at 20:35
  • What error messages exactly do you get? – Šime Vidas Jul 28 '12 at 20:36
  • I get "Script Error." It's the same as the question I linked. The top answer says "The "Script error." happens... when an exception violates the browser's same-origin policy - i.e. when the error occurs in a script that's hosted on a domain other than the domain of the current page." Is this not correct? – jhchen Jul 28 '12 at 20:49
  • That user is writing about loading HTML documents in SCRIPT elements (e.g. ` – Šime Vidas Jul 28 '12 at 21:04
  • Loading the script is fine, but if that remote script throws an error, I only get "script error" which is not very helpful in debugging. I want to know how to utilize a CDN and still get more useful errors. – jhchen Jul 28 '12 at 23:05
  • Chrome's dev tools enable you to pause on errors. Once paused, you can examine the context further. For instance, you can view the stack trace, or the current state of the scope. – Šime Vidas Jul 28 '12 at 23:12
  • You can't load dev tools for just anyone that visits your site... – jhchen Jul 28 '12 at 23:26
  • That script that you're using for error reporting, it doesn't include the stack trace of the error? It just sends the error message? – Šime Vidas Jul 29 '12 at 01:23
  • The stack trace is simply: :0:in `{anonymous}()' – jhchen Jul 29 '12 at 20:29
  • I understand the issue now. However, I have not been able to replicate it. I have created a web-page at [`ecmazing.com/cryptic.html`](http://ecmazing.com/cryptic.html), which includes a script from this URL - [`w3viewer.com/cryptic.js`](http://w3viewer.com/cryptic.js). As you can see, the script is on a different domain. The script throws an error with the message "This is a cryptic error.". When I open the page in Chrome or Firefox, that error message is displayed in the console. So, I am able to read the error message even though the error was thrown in a script from a different domain. – Šime Vidas Jul 29 '12 at 21:27

2 Answers2

1

I had a similar problem: my scripts are served by a subdomain and fall under the same origin restriction. However, I solved this by:

1) adding every script tag like this:

<script type="text/javascript" src="http://subdomain.mydomain.tld" crossorigin="*.mydomain.tld" />

2) modifying the apache httpd.conf by adding the following inside every vhost (you must enbable mod_headers):

<IfModule mod_headers.c>
Header add Access-Control-Allow-Origin "*.mydomain.tld"
</IfModule>

On one of my server I was not able to make this functional except by replacing

*.mydomain.tld

by

*

Be aware of the flaws with potentially allowing * to phish extended information. Documentation on CORS, same-origin, img & fonts, cdn is available but very fewer about script tag crossorigin details is available.

Hope this helps ...

spoutnik
  • 1,139
  • 8
  • 5
  • Is there any way to solve this problem if you are loding a JS file from an external server you don't control (e.g. API provider's server)? – Eugenio Apr 04 '14 at 09:20
0

Try using jsonp for the dataType attribute in jQuery.ajax. The remote server will also need to support jsonp. It will get around the browser security preventing XSS.

Alternatively, you could use an IFrame and use jQuery within each window, but use HTML5 postMessage to communicate back and forth between the windows on two different domains.

Or, if you control both servers you can set the headers for same origin.

Jsonp has been my weapon of choice for this kind of problem. The others are just a legitimate.

mirezus
  • 13,892
  • 11
  • 37
  • 42