Javascript HTTPS GET Restriction

Question

I have made a script which I want the user to insert into their Url bar. The script is below.

javascript:x=new XMLHttpRequest();x.open("GET", "http://example.com/page.php?param1=value1&param2=value2", true); x.send()

The only problem is that the site I intend users to put that into their Url bar is an HTTPS site. For some reason it isn't working because of this. This is the error that I am getting in my Chrome Console:

Mixed Content: The page at 'example.net'; was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'example.com/page.php?param1=value1&param2=value2';. This request has been blocked; the content must be served over HTTPS.

Example.net is the 3rd party site & example.com is my site.

Anyway, is there a way to get past this error? I have been searching all day but with no success. Thanks.

Answer 1

The reason that the script fails is that the AJAX request will be run in the context of the current page. The next issue you'd likely run into is a CORS error even if you were serving your content via HTTPS.

Using the following is probably the safest bet but it'll redirect.

window.location = "http://example.com/page.php?param1=value1&param2=value2"; 

Something like this will also work but might get blocked by popup blockers:

var x = window.open("http://example.com/page.php?param1=value1&param2=value2"); 

Then if you want to close it after a bit then you could do something like

document.setTimeout(function(){
    x.close();

}, 4000);

The only other option I can think of which might work if none of these solutions are suitable is a browser plugin as that would allow you to execute JS in the context of the browser.

Answer 2

您可以代理请求：js在后端调用https://example.com/page.php和page.php，而在http://example.net/ ...