了解受 X-Frame-Options 保护的表单 POST 的状态
我将在下面描述我的具体案例，但这可能对许多网络混搭有用。
我的 Web 应用程序通过填写表单然后提交（通过 JavaScript）来发布到 Twitter。表单的 target 设置为具有 onload 触发器的 iframe。当调用 onload 触发器时，应用程序知道 POST 已完成。
在 Chrome 版本 11 之前，此功能一直运行良好，现在它尊重 Twitter 在 POST 响应中发送的 X-Frame-Options=SAMEORIGIN。 POST 已完成，但 iframe 的 onload 不再被调用。
它在 Firefox 4 中仍然有效，但我认为这是一个最终会得到修复的错误。
还有其他方法可以知道 POST 的状态吗？我知道了解 POST 响应的内容会违反安全策略，但我对这些内容不感兴趣。我只想在 POST 完成时通知应用程序。
I am going to describe my specific case below, but this might be useful to a number of web-mashups.
My web application POSTs to Twitter by filling a form and then submitting it (via javascript). The target of the form is set to an iframe which has an onload trigger. When the onload trigger is called the application knows that the POST was completed.
This used to work fine until Chrome version 11, which now respects the X-Frame-Options=SAMEORIGIN sent by Twitter in the POST response. The POST goes through, but the iframe's onload is not called anymore.
It still works in Firefox 4, but I suppose that's a bug that will eventually get fixed.
Is there any other way to know the status of the POST? I understand that knowing the contents of the POST response would violate the security policy, but I am not interested in the contents. I would just like the app to be notified when the POST is completed.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您只需要知道 POST 何时提交，而不一定知道它是否成功，您可以按一定时间间隔轮询 iframe 的
contentWindow和contentWindow.document。当您无法再访问这些对象之一，或者文档正文为空时，这意味着 iframe 已加载带有X-Frame-Options限制的页面，这可能意味着提交经历了。它很hacky，但看起来它可以用于此目的。 （您可能需要进行一些组合才能弄清楚受限制的 iframe 的内容在目标浏览器中是什么样子。）If you just need to know when the POST was submitted, and not necessarily whether it succeeded or not, you could poll the iframe's
contentWindowandcontentWindow.documenton an interval. When you can no longer access one of those objects, or when the document has an empty body, that means that the iframe has loaded a page withX-Frame-Optionsrestrictions, which likely means that the submission went through. It's hacky, but it looks like it will work for this purpose. (You'll probably have to go through a few combinations to figure out what the contents of restricted iframes look like in your target browsers.)您可以通过获取页面标题来做到这一点。在 php 中，它看起来像，
$url = 'http://www.google.com';print_r(get_headers($url));
You can do it by getting the headers of the page. In php it will be looks like,
$url = 'http://www.google.com';print_r(get_headers($url));