可能拦截来自iframe（相同域）内部的XMLHttpRequest？

Question

I have a page that's loaded using https, and it embeds an iframe on the same domain, also loaded via https.

Inside the iframe, there are some XHR requests to an insecure http URL (the URL is actually to an IP address on the local network) that are being blocked.

Is there any way I can allow the requests to the local IP address? I only have access to edit the code in the parent frame. I can use php or javascript in the parent frame.

Answer 1

Unless you recompile your browser, CORS explicitly prohibits this and no browser would allow it, unless the local IP machine returns valid CORS headers.

See here for CORS headers info: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Simple_requests