<tfoot id='I3Kdx'></tfoot>

<i id='I3Kdx'><tr id='I3Kdx'><dt id='I3Kdx'><q id='I3Kdx'><span id='I3Kdx'><b id='I3Kdx'><form id='I3Kdx'><ins id='I3Kdx'></ins><ul id='I3Kdx'></ul><sub id='I3Kdx'></sub></form><legend id='I3Kdx'></legend><bdo id='I3Kdx'><pre id='I3Kdx'><center id='I3Kdx'></center></pre></bdo></b><th id='I3Kdx'></th></span></q></dt></tr></i><div id='I3Kdx'><tfoot id='I3Kdx'></tfoot><dl id='I3Kdx'><fieldset id='I3Kdx'></fieldset></dl></div>

<legend id='I3Kdx'><style id='I3Kdx'><dir id='I3Kdx'><q id='I3Kdx'></q></dir></style></legend>

从 HTTPS 页面到 HTTP(非 HTTPS)本地主机地址的混合内

时间：2023-10-14

<tfoot id='JGriB'></tfoot>

<i id='JGriB'><tr id='JGriB'><dt id='JGriB'><q id='JGriB'><span id='JGriB'><b id='JGriB'><form id='JGriB'><ins id='JGriB'></ins><ul id='JGriB'></ul><sub id='JGriB'></sub></form><legend id='JGriB'></legend><bdo id='JGriB'><pre id='JGriB'><center id='JGriB'></center></pre></bdo></b><th id='JGriB'></th></span></q></dt></tr></i><div id='JGriB'><tfoot id='JGriB'></tfoot><dl id='JGriB'><fieldset id='JGriB'></fieldset></dl></div>

<legend id='JGriB'><style id='JGriB'><dir id='JGriB'><q id='JGriB'></q></dir></style></legend>

本文介绍了从 HTTPS 页面到 HTTP(非 HTTPS)本地主机地址的混合内容请求未被阻止的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

假设下面的页面是从 https://127.0.100.1 加载的.该页面向 http://127.0.100.2 发出 XMLHttpRequest.这似乎是混合内容:页面通过安全连接加载，资源通过不安全连接加载.混合内容应被浏览器阻止.然而，下面的页面运行良好.* 为什么会运行:为什么请求没有被阻止?

Suppose the page below is loaded from https://127.0.100.1. The page makes an XMLHttpRequest to http://127.0.100.2. This seems like mixed content: The page is loaded over a secure connection and a resource is loaded over an insecure connection. Mixed content should be blocked by the browser. Yet, the page below works just fine.* Why does it work: Why isn't the request blocked?

更新:超越接受的答案，浏览器可以配置来阻止此类地址的混合内容.

Update: Going beyond the accepted answer, browsers can be configured to block mixed content for such addresses.

^{* Wireshark 确认浏览器没有通过安全连接加载资源.}

<html>
<body>
<img id="dst"/>
<script>
  let xhr = new XMLHttpRequest();
  xhr.open('get', 'http://127.0.100.2/img.jpg');
  xhr.responseType = 'blob';
  xhr.onload = function(){
    document.getElementById('dst').src = URL.createObjectURL(xhr.response);    
  }
  xhr.send();
</script>
</body>
</html>

推荐答案

http://127.0.100.2/img.jpg 不被视为混合内容，因为混合内容规范将其定义为先验认证 URL，因为它在 127.0.0.0 - 127.255.255.255 范围内(即具有 CIDR 表示法 127.0.0.0/8 的主机)，根据安全上下文规范被定义为安全上下文——即使协议不是 https.

http://127.0.100.2/img.jpg isn’t considered mixed content because the Mixed Content spec defines it as a special case of an a priori authenticated URL, due to it being in the range 127.0.0.0 - 127.255.255.255 (that is, a host with the CIDR notation 127.0.0.0/8), which per the Secure Contexts spec is defined as a secure context — even if the protocol isn’t https.

http://localhost/img.jpg 或 http://foo.localhost/img.jpg

这篇关于从 HTTPS 页面到 HTTP(非 HTTPS)本地主机地址的混合内容请求未被阻止的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持html5模板网！

上一篇：XMLHttpRequest multipart/form-data:多部分中的边界无效 下一篇：为什么禁止没有凭据的 CORS?

相关文章

最新文章

<legend id='n0xmS'><style id='n0xmS'><dir id='n0xmS'><q id='n0xmS'></q></dir></style></legend>

<i id='n0xmS'><tr id='n0xmS'><dt id='n0xmS'><q id='n0xmS'><span id='n0xmS'><b id='n0xmS'><form id='n0xmS'><ins id='n0xmS'></ins><ul id='n0xmS'></ul><sub id='n0xmS'></sub></form><legend id='n0xmS'></legend><bdo id='n0xmS'><pre id='n0xmS'><center id='n0xmS'></center></pre></bdo></b><th id='n0xmS'></th></span></q></dt></tr></i><div id='n0xmS'><tfoot id='n0xmS'></tfoot><dl id='n0xmS'><fieldset id='n0xmS'></fieldset></dl></div>

<tfoot id='n0xmS'></tfoot>