問題描述
當我們需要調用 Ajax 請求時:
if(typeof XMLHttpRequest !== 'undefined') xhr = new XMLHttpRequest();別的{var 版本 = ["Microsoft.XmlHttp","MSXML2.XmlHttp","MSXML2.XmlHttp.3.0","MSXML2.XmlHttp.4.0",MSXML2.XmlHttp.5.0"];我已經知道使用 XMLHttpRequest-2 ，我們可以做一個跨域請求 AND 添加 ORIGIN 標頭.
問題:
什么時候添加了這個標題?
- 是否在瀏覽器(支持 CORS)執行請求時添加?(跨域還是非跨域?)
- 還是在瀏覽器看到"請求目標來源與當前來源不同時自動添加...
我的意思是:He** 是什么意思?
<塊引用>跨域 HTTP 請求有一個 Origin 標頭.這個標題向服務器提供請求的來源.這個標題是受瀏覽器保護，不能從應用程序代碼中更改.本質上，它是找到的原始屬性的網絡等價物關于跨文檔消息傳遞中使用的消息事件.原始標頭與較舊的referer [sic] 標頭的不同之處在于，referer 是一個完整的 URL，包括路徑.因為路徑可能包含敏感信息，瀏覽器有時不會發送引用試圖保護用戶隱私.但是，瀏覽器將始終必要時發送所需的 Origin 標頭.
Origin標頭
<塊引用>何時添加此標頭?
在標頭階段，文檔正文發送之前(open之后，send之前).
它是在瀏覽器(支持 CORS)發出請求時添加的嗎?(跨域還是非跨域?)
當源與創建XMLHttpRequest的頁面不匹配時添加，但也可以在同源請求中發送.
<塊引用>或者當瀏覽器看到"請求目標來源與當前來源不同時是否自動添加...
是的.
<塊引用>但是，瀏覽器總是會在必要時發送所需的 Origin 標頭.
這是 XMLHttpRequest 規范的一部分；如果您正在發出跨域請求，則會在請求標頭中發送一個額外的標頭.這個標題是例如來源:http://www.stackoverflow.com，由遵循標準的瀏覽器附加，無需用戶交互.
您可以在 MozillaWiki 的安全部分中閱讀有關規范的更多信息，WHATWG 和 html5.組織.它是由(據我所知)FireFox 和 Google Chrome 實現的.我不相信它是 W3C 的一部分.此外不要假設源頭是真實的，因為它可以通過修改后的瀏覽器或其他軟件手動設置.
When we need to invoke an Ajax request we do :
if(typeof XMLHttpRequest !== 'undefined') xhr = new XMLHttpRequest();
else
{
var versions = ["Microsoft.XmlHttp",
"MSXML2.XmlHttp",
"MSXML2.XmlHttp.3.0",
"MSXML2.XmlHttp.4.0",
"MSXML2.XmlHttp.5.0"
];
I already know that using XMLHttpRequest-2 ,we can make a cross origin request AND that the ORIGIN header is added.
Question:
When does this header added ?
- Is it added when a browser (that support CORS) is performing a request ? ( cross domain or non-cross-domain?)
- Or is it added automatically when the browser "sees" that the request target origin is different from the current origin...
I mean : what the He** does the bold line mean ?
Cross-origin HTTP requests have an Origin header. This header provides the server with the request’s origin. This header is protected by the browser and cannot be changed from application code. In essence, it is the network equivalent of the origin property found on message events used in Cross Document Messaging. The origin header differs from the older referer [sic] header in that the referer is a complete URL including the path. Because the path may contain sensitive information, the referer is sometimes not sent by browsers attempting to protect user privacy. However, the browser will always send the required Origin headers when necessary.
The Origin header
When this header is added ?
During the header's stage, before the document's body is sent (after open, before send).
Is it added when a browser (that support CORS) is doing a request ? ( cross domain or non-cross-domain?)
It is added when the origin doesn't match the page from which the XMLHttpRequest is created, but may also be sent in a same-origin request.
Or does it added automatically when the browser "sees" that the request target origin is different from the current origin...
Yes.
However, the browser will always send the required Origin headers when necessary.
This is part of the XMLHttpRequest spec; if you're making a cross-domain request, in the request headers an extra header is sent. This header is e.g. Origin: http://www.stackoverflow.com and is appended by a standards-following browser without user interaction.
You can read more on the specification in MozillaWiki's Security section, WHATWG and html5.org. It is implemented by (that I know of) FireFox and Google Chrome. I don't believe it is part of W3C yet. Further do not assume the origin header is true, as it can be set manually by modified borwsers or other software.
這篇關于CORS 和 Origin 標頭?的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！