Is it possible to use JS Fetch with ViewState cross domain?

Question

I'm using the fetch API to display a webpage inside of a floating widget. The page has a form on it that uses viewstate. It works fine if the widget is on the same domain as the page I'm fetching, but if I put the widget on a different domain, then I get an invalid viewstate error. I have tried several things to resolve the issue, but none work. Does anyone know if it's possible to get this working?

Answer 1

不。如果根据您对widget的定义，您的意思是iframe类的东西，那么如果您尝试在parent frame和iframe之间操作数据，这将导致XSS问题，如果域相同，则不会因为相同-原产地政策。