限制跨域 Ajax 请求 [英] Restrict Cross Domain Ajax request

问题描述

我有一个 web 应用程序(在 java 中)，我需要通过 jquery 或简单的 javaScript ajax 调用在任何浏览器中通过 Ajax 调用来限制跨域请求(包括 IE 限制 XDomainRequest 对象).

I have web application (In java) where I need to restrict Cross Domain request through Ajax call in any browser (Including IE restricting XDomainRequest object) through jquery or simple javaScript ajax call.

我的最终目标是在通过某些浏览器设置或设置响应标头进行调用时限制它，这样它就不会在第一点本身进行调用.

My ultimate aim it to restrict it while the call is made either through some browser setting or setting response header so it wont make the call in the first point itself.

如果同源政策是一种解决方案，请说明它是如何解决的.

If same-orgin policy is a solution pls do explain how it is addressed.

感谢和问候，大洋洲

推荐答案

您可以通过 Access-Control-Allow-Origin 响应头.如果缺少标头，则只允许来自同一域的请求.

You can control which domains you accept AJAX requests from via the Access-Control-Allow-Origin response header. If the header is missing, only requests from the same domain are allowed.

更新:如果您想禁止启动 AJAX 请求，您可以尝试 X-Content-Security-Policy:xhr-src 'none'，但我无法想象会出现什么情况有用.或许你可以更详细地解释一下情况?

Update: if you want to disallow even the initiation of AJAX requests, you could try X-Content-Security-Policy:xhr-src 'none', but I can't imagine any situation where that would be useful. Maybe you could explain the situation in a little more detail?

这篇关于限制跨域 Ajax 请求的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！