SecurityError:操作不安全 - window.history.pushState() [英] SecurityError: The operation is insecure - window.history.pushState()

问题描述

我在 Firefox 的控制台中收到此错误:SecurityError: The operation is insecure 并且有罪的是 HTML5 功能:window.history.pushState() 当我尝试时用 AJAX 加载一些东西.它应该加载一些数据，但 Javascript 因错误而停止执行.

I'm getting this error in Firefox's Console: SecurityError: The operation is insecure and the guilty is HTML5 feature: window.history.pushState() when I try to load something with AJAX. It is supposed to load some data but Javascript stops executing on error.

我想知道为什么会发生这种情况.这是一些服务器配置错误吗?任何帮助将不胜感激.

I'm wondering why this may be happening. Is this some server misconfiguration? Any help would be appreciated.

更新:是的，这是域名不匹配的服务器错误:http://en.wikipedia.org/wiki/Same-origin_policy

UPDATE: Yes, it was a server error with domain name not matching: http://en.wikipedia.org/wiki/Same-origin_policy

推荐答案

确保您遵循 Same Origin政策.这意味着相同的域、相同的子域、相同的协议(http 与 https)和相同的端口.

Make sure you are following the Same Origin Policy. This means same domain, same subdomain, same protocol (http vs https) and same port.

pushState 如何防范潜在的内容伪造?

正如@robertc 在他的评论中恰当地指出的那样，当源是 file:/// 时，一些浏览器实际上实现了略有不同的安全策略.更不用说当页面期望它从不同的来源运行时，在使用 file:/// 本地测试时可能会遇到问题(因此您的 pushState 假设生产源场景，而不是本地主机方案)

As @robertc aptly pointed out in his comment, some browsers actually implement slightly different security policies when the origin is file:///. Not to mention you can encounter problems when testing locally with file:/// when the page expects it is running from a different origin (and so your pushState assumes production origin scenarios, not localhost scenarios)

这篇关于SecurityError:操作不安全 - window.history.pushState()的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！