如何在书签中进行身份验证？
我希望我的书签要求用户登录。 这是想法......我创建一个 iframe 供用户登录，并显示 a/c 信息。 但我想从服务器获取一些信息，例如，我想知道用户是否已经将此页面添加到我的服务器中。所以，我想进行ajax调用，但是由于同源策略，我无法通过ajax来完成。那么，如何从 iframe 中获取信息呢？
故事是这样的：
用户网站 ->用户单击书签 ->如果已登录->显示“添加到收藏夹”按钮 ->用户点击添加到收藏夹按钮，url被提交到服务器，重新加载服务器。
用户网站 ->用户单击书签 ->如果没有登录->显示登录按钮 ->登录成功->按照之前的流程进行操作
用户网站 ->用户单击书签 ->如果已登录 ->检查该网站是否已添加到服务器上 ->没有收藏按钮
如您所见，只有 iframe 存储登录用户的信息。
I would like my bookmarklet to require the user to login.
Here is the idea....I create an iframe for user to login, and show the a/c information.
But I would like to get some information from server, for example, I would like to know whether the user has already added this page to my server or not. So, I want to make an ajax call, but because of the same origin policy, I can't do it by ajax. So, How can I get information from the iframe?
The story is something like this:
User web -> user clicks the bookmarklet -> if logged in -> show an 'add to fav' button -> user clicks the add to fav button, the url is submitted to the server, reload the server.
User web -> user clicks the bookmarklet -> if not logged -> show a login button -> login success -> do the flow as previous
User web -> user clicks the bookmarklet -> if logged -> check if the website is already added on server -> no fav button
As you can see, only the iframe stores the information of the logged in user.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您所做的事情是不可能的，因为它违反了源继承规则。这样想吧。如果您可以从其他网站获取这种风格的信息，那么您可以阅读 CSRF 令牌，或者从某人的 Gmail 帐户中读取其电子邮件。
说到 CSRF，大多数登录只是一个带有用户名/密码的简单帖子。您在网站上构建一个简单的
当然，这并不适用于所有应用程序，例如 OpenID 或 gmail。这是因为这些服务通常在登录请求中包含随机值。
What you are doing is impossilbe because it violates the origin inheritance rules. Think of it this way. If you could obtain information from another website in this fasion then you could read CSRF Tokens, or read someone's email from their gmail account.
Speaking of CSRF, most logins are just a simple post with a username/password. You build a simple
<form>on your website that is identical to the POST request needed to login. Using JavaScript you can call.submit()on the form which would redirect the browser to their newly authenticated session. In fact this is how a POST based CSRF exploit works (although usually in a CSRF attack you assume the browser is already authenticated.).Of course this won't work for all applications, like OpenID or gmail. This is because these services often include random value along with the login request.