-7

I would like to use jquery in a HTML file which I open with the file: protocol like this:

file:///path/to/file.html

I include jquery in this HTML like this:

<script
    src="https://code.jquery.com/jquery-3.3.1.min.js"
    integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8="
    crossorigin="anonymous"></script>

My browser (firefox) tells me, that the CORS headers are missing:

https://developer.mozilla.org/de/docs/Web/HTTP/CORS/Errors/CORSMissingAllowOrigin

It would be great, if I could develop with a HTML from file:// and jquery from CDN.

One use case is for education. If you can create a HTML and test it via file: protocol (loading jquery from CDN), then the initial overhead for new comers is much lower (at least I think so, but maybe I am missing something).

guettli
  • 25,042
  • 81
  • 346
  • 663
  • 4
    *"It would be great, if I could develop with file:// and jquery."* You cannot do so. – Kevin B Sep 28 '18 at 20:52
  • @KevinB why is this not possible? – guettli Oct 01 '18 at 07:24
  • 3
    Technically, it is possible to do what you are asking. but it opens up quite the security hole. https://stackoverflow.com/questions/4819060/allow-google-chrome-to-use-xmlhttprequest-to-load-a-url-from-a-local-file There's a reason this is disabled by default and only enableable via a flag (assuming said flag still exists) I would not suggest browsing anything other than your local network while this flag is enabled. – Kevin B Oct 01 '18 at 15:35
  • 1
    This approach demands turning on a security-mitigating switch on the web browser, and instructing students about the risks involved as they browse the web. Installing and configuring IIS on the local PC is easier, safer and a more useful experience for students, IMHO. – Ruud Helderman Oct 02 '18 at 11:00
  • @KevinB you say it is not possible. It works very well. See my answer here: https://stackoverflow.com/a/52919504/633961 I am curious. Why do you think it is not possible? – guettli Nov 15 '18 at 12:21

2 Answers2

1

If your problem is entry, then use one of the many fiddle tools available.

jqfiddle has an html, css and a jquery part you can fill in. It should support all the basic examples you need, and also some advanced. But since we are talking "entry level" then this should suffice to show what you can do. And then get into how to set all this up locally or on a server later.

You could also just setup a single server with userfolders they could upload too via ftp locally and then host those user folders (that would require more setup on your part however).

Or use something like github pages to host the content. Getting students that want to learn to code, involved in a platform like github, is also great for exploration and learning.

Update: After OPs answer to his own question i wanted to what the actual problem was to this answer:

  integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8=" crossorigin="anonymous">

The above was added to the tag where the file was loaded.

This is a security feature used when loading external resources, called: Subresource Integrity

The content of the integrity attribute needs to match a hash generated from the file being loaded, and is really only used when your code and the resource are in different locations (Cross Origin) it protects your site against the file being changed on the third-party site.

The hash ensures that the code you expect is the one being loaded from the third-party, if it has changed (been hacked) the code won't be executed on your page.

So in your local case you would have to generate a new hash from the file content, every time your code changed, and put that into the integrity attribute, this doesn't really make sense if the resources are at the same location, since an attacker could just modify your site instead of the actual script file.

Futher update: If you want to test something from a file it should be possible with a simple html file like the following, it also loads the script from a cdn with SRI without a problem.

<html>
<head>
<script src="https://code.jquery.com/jquery-3.3.1.slim.js"
  integrity="sha256-fNXJFIlca05BIO2Y5zh1xrShK3ME+/lYZ0j+ChxX2DA="
  crossorigin="anonymous"></script>
</head>
<body>
<h1>Hello World!</h1>

<script type="text/javascript">
  $("body").append("<span>I was added from jquery script!</span>");
</script>

The script is copy/pasted directly from the snippet provided from jquery's cdn

Jim Wolff
  • 5,052
  • 5
  • 34
  • 44
  • The first constructive suggestion after ten down-votes. Thank you for this answer! – guettli Oct 08 '18 at 10:22
  • @guettli i added some elaboration on the problem you faced, in this update. – Jim Wolff Nov 15 '18 at 09:07
  • @JimWollf you wrote "So in your local case you would have to generate a new hash from the file content, every time your code changed". I can't follow you. I want to load jquery. I do no modify jquery. I do not understand why I should generate a new hash. – guettli Nov 15 '18 at 12:19
  • @guettli correct, therefore it makes no sense to use **subresource integrity** locally, or anywhere where a script is physically located in the same place as the html calling it. I just tried to explain how the feature works if you were to use it. – Jim Wolff Nov 15 '18 at 12:26
  • yes, it makes not sense. But "why not"? I want to play around with a html+jquery snippet locally via file:///. It makes no sense to be forced to remove the integrity="sha256-..." attribute before being able to test the snippet. – guettli Nov 15 '18 at 14:11
-1

I added this, just because the jquery page told me to do this:

  integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8="
    crossorigin="anonymous">

All I want is to test my HTML including jquery via file:/// and the solution, and answer to the question is very easy: Just do not use integrity="... and it works.

My HTML contains this now:

 <head>
  <link rel="stylesheet" href="https://code.jquery.com/ui/1.12.1/themes/base/jquery-ui.css">
  <script src="https://code.jquery.com/jquery-1.12.4.js"></script>
  <script src="https://code.jquery.com/ui/1.12.1/jquery-ui.js"></script>

And playing around via file:/// works.

I see that there is a major difference in the jquery version. But I don't care at the moment.

Above HTML is from this page: http://jqueryui.com/accordion/#collapsible

guettli
  • 25,042
  • 81
  • 346
  • 663
  • One of your issues might also have been the integrity link itself, since the link i get when i check jquery's cdn is this: `` the hash is different from your above hash – Jim Wolff Nov 15 '18 at 12:35
  • nevermind, i was comparing your new code to the previous one, which was jquery.3.3.1 and that does give the correct hash: `` – Jim Wolff Nov 15 '18 at 12:38