Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am posting this question on Stack Overflow as well. In my opinion this question overlaps the two...


I am creating a simple JavaScript wrapper for CouchDB's REST-ful interface, but I am stuck on same-origin policy issues.

So far I've been developing my code to work locally - and only as a proof of concept - on Mozilla FireFox. My server is running on localhost, port 5984.

To disable cross-origin policy in Mozilla FireFox you can use the PrivilegeManager, but it only gets me half-way in the sense that I can't do PUT requests against my server...

/*
 * Including this in my JavaScript file only seems to disable cross-origin
 * policy checks for POST and GET requests in Mozilla FireFox.
 * PUT requests fail.
 */

netscape.security.PrivilegeManager.enablePrivilege(
    "UniversalBrowserRead UniversalBrowserWrite"
);



Is there any way that I can configure my server to hide it's location so I won't have to implement browser-specific work-arounds to avoid same-origin policy issues? If not: what browser work-arounds exist to disable same-origin policy completely?

share|improve this question
    
I think such questions are to be asked in SO. For server related queries there is another place ...i don't remember its name. May be some else could mention it for you –  subanki Sep 7 '10 at 19:13

1 Answer 1

Same origin policies (SOPs) were developed to prevent injection of information from one context/domain to another. They are implemented and enforces by the browser. Each vendor may have his own SOPs. So any workaround may work for one browser while it will fail on another one.

IMHO the best (and only?) option is to use some kind of proxy.

If you are using Apache for hosting your webapp you can easily set up a reverse proxy. I accepts requests and sends them to the real service (REST-API). The response will be send back to the Browser. The SOP won't apply since the endpoint of the REST-API won't be in another domain (i.e. another server) but in the domain of your webapp (thanks to the proxy).

[edit] Here's a better explanation: http://developer.yahoo.com/javascript/howto-proxy.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.