JavaScript跨域调用：从HTTP到HTTPS的调用
我需要对同一域的安全 (HTTPS) URL 进行异步调用。
目前该页面正在使用常规 HTTP（非安全）。
换句话说：这是调用同一域中但使用 HTTPS 的 URL。
在将此调用切换到 HTTPS 之前，我结束了实现服务器端代理以允许跨域 AJAX 调用，但现在我面临同源策略，因为 HTTP 和 HTTPS 也被视为不同的来源。所以这个代理是无法使用的。
摘要：在这种情况下如何执行跨域、异步 POST 请求？
各种注释：
- 我无法接受任何建议 JSONP 的答案。异步调用必须使用 POST 动词。
- 我正在使用最新版本的 jQuery。答案可以基于这个库，或者任何其他解决这个问题的库。
- 通过 HTTPS 访问整个页面并不是解决方案。
- 服务器平台是Microsoft .NET 4.0 (ASP.NET 4.0)。
UDPATE：CORS 不是一个选项。现代浏览器对此没有广泛支持。
I need to make an asynchronous call to a secure (HTTPS) URL for the same domain.
Currently the page is working with regular HTTP (non-secure).
In other words: this is calling an URL in the same domain but using HTTPS.
Before switching this calls to HTTPS I ended implementing a server-side proxy to allow cross-domain AJAX calls, but now I'm facing same origin policy since HTTP and HTTPS are considered different origins too. So this proxy is unusable.
Summary: how to do cross-domain, asnynchronous POST requests in this scenario?
Various notes:
- I couldn't accept any answer suggesting JSONP. Asynchronous calls must be using POST verb.
- I'm using latest version of jQuery. Answer could be based on this library, or any other solving this problem.
- Accessing the entire page over HTTPS isn't a solution.
- Server platform is Microsoft .NET 4.0 (ASP.NET 4.0).
UDPATE: CORS isn't an option. There's no wide support for this in modern browsers.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
首先，我对@missingo 和@PiTheNumber 的两个问题都+1。
花了很多时间后，我得出的结论是我要把整个页面切换到 HTTPS。这是因为：
大多数现代浏览器都支持 CORS，但是 Internet Explorer 从第 8 版开始有一个专有的实现（XDomainRequest 对象），该实现可能在某些计算机中被禁用（我的浏览器在 Internet 安全区域中默认禁用跨域请求） ）。
Opera 不支持 CORS。第 12 版将支持它，但这不是一个选择，因为用户应该首先采用这个新版本，而且这不会在 2 天内实现。
我需要执行跨域请求，因为 Web 客户端应用程序必须请求位于另一个域中的 RESTful 服务层。没办法。
将所有内容切换为 HTTPS 会使服务层代理方法再次工作（这是预期的行为）。
无论如何，谢谢，因为这两个答案对我得出这个结论有很大帮助。
更新
@Sam 添加了任何人都可能感兴趣的评论。这是关于如何在 Internet Explorer 8 和 9 中获取 CORS（请参阅#7）：http://blogs.msdn.com/b/ ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds.aspx
First of all, I've +1 both questions from @missingo and @PiTheNumber.
After spending a lot of hours, I've arrived to the conclusion I'm going to switch the entire page to HTTPS. That's because:
Most moderns browsers support CORS, but Internet Explorer, starting from 8th version has a proprietary implementation (XDomainRequest object), which may be disabled in some computers (mine had cross-domain request disabled by default in Internet security zone).
Opera doesn't support CORS. 12th version will support it, but this isn't an option as users should adopt this new version first, and this won't be in 2 days.
I need to do cross-domain requests since Web client application must request a RESTful service layer located in another domain. No way.
Switching everything to HTTPS makes the service layer proxy approach work again (this is the expected behavior).
Thanks anyway because both answer have helped me a lot for arriving to this conclusion.
UPDATE
@Sam has added a comment that could be interesting for anyone. It's about how to get CORS in Internet Explorer 8 and 9 (see #7): http://blogs.msdn.com/b/ieinternals/archive/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds.aspx
我正在使用 Access-Control-Allow-Origin。您只需发送标头就可以了。
另请参阅 AJAX、子域和 SSL
I am using Access-Control-Allow-Origin. You just send the header and you are fine.
See also AJAX, Subdomains, and SSL
您应该重新考虑通过 HTTPS 访问整个页面，或者至少确定这是不可行的。
通过通过 HTTP 加载初始页面和脚本，用户无法安全保证该脚本是您最初打算发送的脚本，并且不会被第三方操纵（例如，通过键盘记录其密码）。这意味着任何绕过 SOP 的 HTTPS 请求都不会提供与来自最初通过 HTTPS 提供服务的页面的 HTTPS 请求相同的安全保证。
You should reconsider accessing the whole page over HTTPS or at least be really sure this is not feasible.
By loading the initial page and script over HTTP the user has no security guarantee that the script is the one you originally intended to send and is not being manipulated by a third party (by, for example, keylogging his password). This means that any HTTPS request that bypasses the SOP will not provide the same security guarantees as a HTTPS request from a page originally served over HTTPS.
有没有人看过：
https://github.com/jpillora/xdomain
它使用 postMessage 和 iframes 来实现cors 请求，并且是跨浏览器的（无需在 IE 中咬紧牙关 XDomainRequests）。
也许它会允许跨协议 cors 请求？
Has anyone looked at:
https://github.com/jpillora/xdomain
It uses postMessage and iframes to achieve cors requests, and is cross browser (no need for teeth clenching XDomainRequests in IE).
Perhaps it will allow cross protocol cors requests?