X
Bakstelėkite čia, kad pereitumėte į mobiliąją šios svetainės versiją.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

How to enable cross-domain AJAX access in Firefox?

Posted

I'm working on development of a HTML5 web application that requires accessing resources from other domains through AJAX. On Chrome browser, there is a nice way to disable web security and allow cross-domain access for AJAX. However, when it comes to Firefox, there isn't an answer that I found. I'm sure this questions might have been asked a multiple times in various forums. But, does Firefox provide a way to disable this security feature and enable cross-domain access?

Product information: I'm running the latest Firefox on Windows 7 box.

Additional System Details

Installed Plug-ins

  • Next Generation Java Plug-in 10.15.2 for Mozilla browsers
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Google Update
  • 5.1.20125.0
  • Microsoft Lync 2010 Meeting Join Plug-in
  • Adobe PDF Plug-In For Firefox and Netscape 11.0.0

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0

More Information

jscher2000
  • Top 10 Contributor
2365 solutions 20923 answers

The same-origin policy is an important security protection for browser users. It's what prevents third party sites from reading your traffic, vacuuming up your cookies, manipulating an open page from an iframe, and taking action on your behalf by hijacking your session. I assume that when you disable the same-origin policy in Google that you do not visit any sites you and your company do not personally control. More info: Same Origin Policy Part 1: No Peeking - IEInternals - Site Home - MSDN Blogs.

The official solution is to use Cross-Origin Resource Sharing in the app: https://developer.mozilla.org/en-US/d.../Access_control_CORS. If you have difficulty implementing this, you can get some assistance on the mozillaZine Web Development / Standards Evangelism forum.

oscargodson 0 solutions 1 answers

We know that. I don't want to keep it on, just turn it on while testing locally to a remote API. I don't want to allow localhost on my server!

jscher2000
  • Top 10 Contributor
2365 solutions 20923 answers

Hi oscargodson, yes, localhost sounds like a really bad idea. However, you might be able to edit your configuration file to add an "unguessable" server name with the same root as your localhost instance. Just a thought, I've never tried it myself.