限制跨域ajax请求
我有一个Web应用程序（在java中），我需要通过jquery或简单的javaScript ajax调用在任何浏览器（包括IE限制XDomainRequest对象）中通过Ajax调用来限制跨域请求。
我的最终目标是在通过某些浏览器设置或设置响应标头进行调用时限制它，这样它就不会在第一点本身进行调用。
如果同源策略是一个解决方案，请解释它是如何解决的。
谢谢和问候， 奥申维贾伊
I have web application (In java) where I need to restrict Cross Domain request through Ajax call in any browser (Including IE restricting XDomainRequest object) through jquery or simple javaScript ajax call.
My ultimate aim it to restrict it while the call is made either through some browser setting or setting response header so it wont make the call in the first point itself.
If same-orgin policy is a solution pls do explain how it is addressed.
Thanks and regards,
Oceanvijai
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以通过 控制接受来自哪些域的 AJAX 请求Access-Control-Allow-Origin 响应标头。如果标头丢失，则仅允许来自同一域的请求。
更新：如果您想禁止发起 AJAX 请求，您可以尝试
X-Content-Security-Policy:xhr-src 'none'，但我无法想象在任何情况下这会有用。也许你可以更详细地解释一下情况？You can control which domains you accept AJAX requests from via the Access-Control-Allow-Origin response header. If the header is missing, only requests from the same domain are allowed.
Update: if you want to disallow even the initiation of AJAX requests, you could try
X-Content-Security-Policy:xhr-src 'none', but I can't imagine any situation where that would be useful. Maybe you could explain the situation in a little more detail?