Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.javascript,comp.lang.php,comp.infosystems.www.authoring.html,comp.infosystems.www.authoring.misc Subject: Re: Chrome and passing on cross-origin Followup-To: comp.lang.javascript Date: Sun, 18 Oct 2020 16:14:02 +0200 Lines: 27 Message-ID: References: <2924c70d-67bd-468a-a480-bd1741bb1158n@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net 8T7gJlwQjyEWJtuP/T1PbAaAWDFXi49OIIuBy931jjvkfkGuu6 Cancel-Lock: sha1:2DHuTUBxxXt5mJ5mYVPAXf1Wapk= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.12.0 In-Reply-To: Content-Language: en-US-large Xref: csiph.com comp.lang.javascript:38987 comp.lang.php:18392 comp.infosystems.www.authoring.html:6976 comp.infosystems.www.authoring.misc:68 On 18/10/2020 14.37, The Doctor wrote: > In Firefox, Waterfox, SeaMonkey, Opera and other similar browsers > > if the nginx.conf lines I comment above are turn off, the page > fails like it does in Chrome, but when I turn comment the > mention configuration line, Firefox et al works, and Mozilla observer > is not happy. > > I need to get this solved like yesterday! This is unrelated to PHP, this is about crossdomain javascript. Nowadays you should tell which domains are ok to include 3rd party javascript, the more specific you can be the better. You should avoid of including 3rd party scripts, have a local copy which you have verified with checksums that it's thew correct script and serve it from your domain. Don't forget to keep it updated so you won't have a bad vulnerability that someone can take advantage of. -- //Aho