background preloader

HTTP access control - MDC

HTTP access control - MDC
A resource makes a cross-origin HTTP request when it requests a resource from a different domain than the one which the first resource itself serves. For example, an HTML page served from makes an <img> src request for Many pages on the web today load resources like CSS stylesheets, images and scripts from separate domains. For security reasons, browsers restrict cross-origin HTTP requests initiated from within scripts. The Cross-Origin Resource Sharing (CORS) mechanism gives web servers cross-domain access controls, which enable secure cross-domain data transfers. This article is for web administrators, server developers, and front-end developers. This cross-origin sharing standard is used to enable cross-site HTTP requests for: Invocations of the XMLHttpRequest or Fetch APIs in a cross-site manner, as discussed above. Overview Subsequent sections discuss scenarios, as well as provide a breakdown of the HTTP headers used. Simple requests

nsIHttpChannel - MDC This interface allows for the modification of HTTP request parameters and the inspection of the resulting HTTP response status and headers when they become available. Inherits from: nsIChannelLast changed in Gecko 1.3 To create an HTTP channel, use nsIIOService with a HTTP URI, for example: var ios = Components.classes["@mozilla.org/network/io-service;1"] .getService(Components.interfaces.nsIIOService); var ch = ios.newChannel(" null, null); Method overview Attributes Methods Get the value of a particular request header. ACString getRequestHeader( in ACString aHeader ); Parameters aHeader The case-insensitive name of the request header to query (For example "Cache-Control"). Return value The value of the request header. Exceptions thrown If the header is not set. Get the value of a particular response header. ACString getResponseHeader( in ACString header ); header The case-insensitive name of the response header to query (For example "Set-Cookie"). isNoCacheResponse() None. aNewURI

Setting HTTP request headers - MDC HTTP is one of the core technologies behind the Web. In addition to the actual content, some important information is passed with HTTP headers for both HTTP requests and responses. You can add your own HTTP headers to any request the application makes, whether the request is initiated by your code explicitly opening an HTTP channel, because of XMLHttpRequest activity, an <img> element in content, or even from CSS. HTTP Channels When you deal with HTTP requests and responses, typically you are doing this with an nsIHttpChannel. The nsIHttpChannel interface has a number of properties and methods, but the method that is of interest to us is setRequestHeader. Below is some sample code where we set an HTTP header. httpChannel.setRequestHeader("X-Hello", "World", false); In the example code above we have a variable named httpChannel which points to an object implementing nsIHttpChannel. The setRequestHeader method takes 3 parameters. No longer the case: Observers

Getting Started - MDC This article guides you through the AJAX basics and gives you two simple hands-on examples to get you started. What's AJAX? AJAX stands for Asynchronous JavaScript and XML. The two features in question are that you can: Make requests to the server without reloading the page Receive and work with data from the server Step 1 – How to make an HTTP request In order to make an HTTP request to the server using JavaScript, you need an instance of a class that provides this functionality. As a result, in order to create a cross-browser instance (object) of the required class, you can do the following: var httpRequest;if (window.XMLHttpRequest) { httpRequest = new XMLHttpRequest();} else if (window.ActiveXObject) { httpRequest = new ActiveXObject("Microsoft.XMLHTTP");} Note: For illustration purposes, the above is a somewhat simplified version of the code to be used for creating an XMLHTTP instance. Next, you need to decide what you want to do after you receive the server response to your request. <?

How to detect HTTP status from JavaScript XMLHttpRequest Call From Ajax Patterns Evidence: 3/3 Tags: Call Callback Download Live Query Remoting RemoteScripting Upload XMLHttpRequest shakopee homes Diagram: Script in Web page issuing XMLHttpRequest Call to server Reta's purchasing some items from a wholesaler's website. How can the browser communicate with the server? Ajax applications require browser-server communication. Use XMLHttpRequest objects for browser-server communication. To begin with, let's think about where the call goes. That sort of thing's not very useful for XMLHttpRequest Calls, which tend to be quite specific in nature, e.g. a query like "What's the user's account balance?" Here's a one-liner "web service" that's running at Ajaxify, where all the demos reside: You can try the service by entering Now the fun part: calling the service from JavaScript. var xhReq = new XMLHttpRequest(); xhReq.open("GET", "sumGet.phtml? How can XMLHttpRequests be created? Creating XMLHttpRequest Objects

Using the XML HTTP Request object This article was originally written in April 2002, I've decided to fix and update it as the objects finally seem to be getting some popularity. The 2002 version is still available, as are the September 2004 and August 2005 versions. This version January 2006. Internet Explorer on Windows, Safari on Mac OS-X, Mozilla on all platforms, Konqueror in KDE, IceBrowser on Java, and Opera on all platforms including Symbian provide a method for client side javascript to make HTTP requests. From the humble begins as an oddly named object with few admirers, it's blossomed to be the core technology in something called AJAX [ 1 ]. The Object makes many things easier and neater than they other would be, and introduces some things that were otherwise impossible such as HEAD requests to see when a resource was last modified, or to see if it even exists. Why HTTP Request object? Creating the object How do I make a request? Making a HTTP request is very simple. Try the example. Does a url exist? Nearby...

X-FRAME-OPTIONS in Firefox As I promised in my previous posts about so called IE8’s “Clickjacking protection”, some hours ago I released the NoScript 1.8.9.9 development build, featuring experimental but complete compatibility with the X-FRAME-OPTIONS header support introduced by IE8 and unveiled yesterday by Eric Lawrence on the IE Blog. As I said previously, this is just a cross-browser compatibility effort: neither Firefox nor NoScript really need this feature. However I also said this is nice to have. More important, not every IT manager will have a chance of reading the reasons I exposed so far, explaining why IE8 has no more “Clickjacking protection” than its competitors. So let’s add this bullet, even if it does nothing against Clickjacking that “alternative browsers” couldn’t already do with traditional frame busting. The following screenshot shows the original IE8 implementation as can be tested on my demo page:

Getting Source Tab When Listening to http-on-modify-request • mo . I dont want to bash the firefox developers and i think firefox is actually pretty good and potentially ver powerfull for writing extensions, but the documentation is a big obstacle (for me atleast). There isn't hardly any real detailed documentation, its always scraps and peaces and some examples. If it doesn't work, you NEED the forums. on topic: I know how to use the functions, but are they permanent? I REALLY like it i can make seperate sandboxed http-connections for every tab, but i dont want to trade stability for functionallity . Creating Sandboxed HTTP Connections - MDC Introduction Starting with Gecko 1.8.1 (Firefox 2), it is possible to create sandboxed HTTP connections which don't affect the user's cookies. This article will cover the basics of doing HTTP connections from XPCOM JavaScript, and should easily translate to C++ XPCOM. Setting up an HTTP connection The first step in setting up an HTTP connection from an URL (stored in a string) is to create an nsIURI out of it. nsIURI is an XPCOM representation of an URI, with useful methods to query and manipulate the URI. var ioService = Components.classes["@mozilla.org/network/io-service;1"] .getService(Components.interfaces.nsIIOService);var uri = ioService.newURI(myURLString, null, null); Once the nsIURI has been created, a nsIChannel can be generated from it using nsIIOService's newChannelFromURI method: var channel = ioService.newChannelFromURI(uri); To initiate the connection, the asyncOpen method is called. channel.asyncOpen(listener, null); HTTP notifications Handling cookies HTTP referrer

Related: