同源策略不起作用

Question

I am trying to understand the same origin policy with a small demo that i have created.我试图通过我创建的一个小演示来理解同源策略。 But somehow something is going wrong.但不知何故出了问题。 Below are the html files on 2 different domains (virtual domains that i hosted in XAMP) :-以下是 2 个不同域（我在 XAMP 中托管的虚拟域）上的 html 文件：-

domain1.com域名1.com

<html>
<title>
 DOMAIN1.COM
</title>
<script>
 function showTheirSecret() 
 {
var   stolenSecret=document.getElementById('stealSecret').contentWindow.document.getElementsByName("mySecret")[0].value;
if (stolenSecret)
{
    alert("Script on this page accessed the secret box and says "+stolenSecret);
}
else
    alert("Script on this page can not access the secret box!! ");  
}
</script>
<body>
  WELCOME TO <h1>domain1.com</h1><br>
  This is the contents on domain1.com. <br>
  These can not be accessed by domain2.com
  <br>
  <br>
  <iframe id="stealSecret"  src="http://localhost/~user/training/domain2.com/"></iframe>
  <br>
  <br>
  <h2>
  Click the "ok" button to see domain 2's secret text.
  </h2>
  <input type="button" value="stealData" onclick="javascript:showTheirSecret()">
  </body>
</html>

domain2.com域名2.com

<html>
<title>
  DOMAIN2.COM
</title>
<script type="text/javascript">
function showMe() 
{
var secret=document.getElementsByName("mySecret")[0].value;
if(secret)
{
    alert("Script on this page accessed the secret box and says "+secret);
}
else
    alert("Script on this page can not access the secret box!! ");
}
 </script>
 <body>
   WELCOME TO <h1>domain2.com</h1><br>
   This is the contents on domain2.com. <br>
   These can not be accessed by domain1.com
   <br>
   <h2> 
   Put your secret text here !! 
   </h2> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
   <h2>
Click the "ok" button to see your own text.
</h2>
<input type="password" name="mySecret" value ="">
<input type="button" value="ok" onclick="javascript:showMe()">
</body>

Now lets say I am on domain1.com and in the iframe (that holds domain2.com), i put in some text in the text box in the iframe.现在假设我在 domain1.com 和 iframe（包含 domain2.com）中，我在 iframe 的文本框中输入了一些文本。 Now i click on the "stealData" button.现在我点击“stealData”按钮。 So ideally, what I am expecting here is that the same origin policy should kick in and i should not be allowed to access the contents of the text box in the iframe.所以理想情况下，我在这里期待的是同源策略应该启动，我不应该被允许访问 iframe 中文本框的内容。 And the same should be visible as an error in the java script console in Firefox.同样应该在 Firefox 的 java 脚本控制台中作为错误可见。 But this does not really happen.但这并没有真正发生。 WHY ?为什么？

Answer 1

Thanks to all.谢谢大家。 After going through RichieHIndle's comment, I realized it was a mistake in setting up the domains itself.在阅读 RichieHIndle 的评论后，我意识到设置域本身是一个错误。 My httpd-vhosts.conf entries for my domains were incorrect.我的域的 httpd-vhosts.conf 条目不正确。 Rectifying this file did the job and I got what I was expecting.纠正这个文件完成了工作，我得到了我所期待的。 I could see the same origin policy in action.我可以看到相同的起源政策在起作用。

同源策略不起作用

问题描述

1 个解决方案

解决方案1
0 2014-03-25 21:03:30

同源策略不起作用

问题描述

1 个解决方案

解决方案1 0 2014-03-25 21:03:30

解决方案1
0 2014-03-25 21:03:30