防止 javascript GET 和脚本
有没有办法将 Javascript Get、Post 请求限制到指定域？ 我还可以以某种方式禁用 JSONP 吗？
我想开发一个 Web 内容框架，人们可以在不同的页面中包含 javascript，但我不希望这些脚本访问任何其他域。
我熟悉 Firefox 的“内容安全策略”，但不幸的是这仅适用于 Firefox。
Is there anyway to limit Javascript Get, Post request to a specified domain?
Also can I somehow disable JSONP?
I want to develop a web content framework where people can include javascripts in different pages but I don't want those scripts to access any other domain.
I am familiar with firefox "Content Security Policy" but unfortunately that is only applicable to firefox.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
默认情况下它是“禁用”的。如果你想“允许”json，你必须添加 jsonp 回调。没有它，js 就无法检索 json 响应。
It's "disabled" by default. If you want to "allow" json, you would have to add jsonp callback. Without it, js isn't able to retreive json response.
您能否让用户从批准的脚本列表中进行选择，并在脚本未包含在正确的域中时拒绝编辑，而不是让用户选择任意 javascript？
或者您可以使用某种自定义标记，而不是允许编写 -tags，而是编写 [include="pluginname"]，然后您自己将其转换为脚本标记，如果找到具有给定名称的插件？
内容安全策略在 Chrome 中的支持也有限，但目前它并不是您真正想要的，因为它在市场上的支持和渗透率有限。
Instead of letting the users pick arbitrary javascripts, can you let them pick from a list of approved scripts, and rejects the edits if the scripts are not included from the right domain?
Or can you use some sort of a custom markup, where instead of being allowed to write -tags, they write [include="pluginname"], and you convert that to a script tag yourself, it the plugin with the given name is found?
Content Security Policy is also has limited support in Chrome, but currently it's not really what you want, as its support and penetration in the market is limited.