XMLHttpRequest cross site scripting?

Question

I realize this issue of cross site scripting has been covered, however being new to web development I had a few further questions.

Currently I am testing an html file I wrote on my PC connecting to a RESTFul web service on another machine. I am getting status=0 . Is this considered cross-site scripting?

If a server hosts a file with javascript, and that javascript file has XMLHttpRequest s to the server's own web services, will that work, or is that bad?

Apologies if any of these questions are stupid.

Answer 1

status=0 can me a variety of things, and without knowing more about how you got to that point, it is very difficult to determine what, exactly, it means. You could be using an iframe, the other computer could genuinely be telling you that the status is 0... we don't know.

---

The general rule is that it doesn't matter where the JS is from , it will execute the data where it's loaded . This is what makes the Google js archiving api possible (you know, use https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.js on a whole assortment of locations). And honestly, that is not a security issue.

The security issue comes in when a js file tries to access another domain (or even subdomain), whether through manipulation of an iframe or through XMLHTTPRequest. It's at that point that the browser will "lay the smackdown" on the script.

You will have difficulty communicating with JavaScript from your hard drive (file:///) to any internet protocol (http|https) because of this.

Answer 2

No, that is not cross site scripting. When including script JS file from another server it is rendered in your site so You won't be able to access through XMLHttpRequest site where JS script is originally located.

If that is possible than anybody who host jQuery file, there are many servers including google, would be opened for XMLHttpRequests.

SO, IT'S NOT POSSIBLE.

If you want JSON response from another server you can use pjson. Google it for more info.

And Cross Site Scripting is when someone injects JavaScript code on your site in order to bypass access control.

Answer 3

You can use CORS for that. You can use the same code you use now, but the other server you request the page from via ajax has to sent the following header on that page

Access-Control-Allow-Origin: http://yoursite.example.com
#or to allow all hosts
Access-Control-Allow-Origin: *