我想做这样的事情:

var w = window.open("javascript: makeAnAjaxRequest();");

我的问题是，Ajax 请求(在新窗口打开后执行)是否会被视为跨站点请求？同域策略是否适用于其页面创建窗口的原始域？

回应您的一些评论:

someAjaxFunction() 只需发出 Ajax 请求并能够对结果进行操作。我知道必须在我打开的窗口中定义该功能。没问题;我有一个正在使用的缩小的 ajax 函数，我也可以将其注入(inject)到 URL 中。重点是查看请求的限制是什么；即，同域策略将应用于哪个域？

最佳答案

来自谷歌的一些信息:http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_DOM_access

With no additional qualifiers, the term "same-origin policy" most commonly refers to a mechanism that governs the ability for JavaScript and other scripting languages to access DOM properties and methods across domains (reference). In essence, the model boils down to this three-step decision process:

If protocol, host name, and - for browsers other than Microsoft Internet Explorer - port number for two interacting pages match, access is granted with no further checks. Any page may set document.domain parameter to a right-hand, fully-qualified fragment of its current host name (e.g., foo.bar.example.com may set it to example.com, but not ample.com). If two pages explicitly and mutually set their respective document.domain parameters to the same value, and the remaining same-origin checks are satisfied, access is granted. If neither of the above conditions is satisfied, access is denied.

来自 Mozilla 的信息

I can not access the properties of the new secondary window. I always get an error in the javascript console saying "Error: uncaught exception: Permission denied to get property . Why is that?

It is because of the cross-domain script security restriction (also referred as the "Same Origin Policy"). A script loaded in a window (or frame) from a distinct origin (domain name) cannot get nor set properties of another window (or frame) or the properties of any of its HTML objects coming from another distinct origin (domain name). Therefore, before executing a script targeting a secondary window, the browser in the main window will verify that the secondary window has the same domain name. More reading on the cross-domain script security restriction: http://www.mozilla.org/projects/secu...me-origin.html

所以你的答案是

1. 因此，如果除 IE 之外的所有浏览器的协议(protocol)、主机名和端口都匹配，那么它就是同一个域
2. 如果 IE 的协议(protocol)和主机名匹配，则为同一域

否则，您将受到限制。

编辑 - 真正的答案

window.open('javascript:doFunction()') 除了打开一个新的空白窗口外不会执行任何操作，该窗口无法执行任何操作，因为未定义 doFunction。需要在同一个窗口中定义。

旁注 我可以通过将 ajax 直接注入(inject) url 来执行同源 xhr 请求，但它仍然容易受到同域策略的影响。

x = window.open('javascript:x = new XMLHttpRequest; x.open("GET", "http://medero.org", false); x.onreadystatechange = function(){ if ( x.readyState != 4 ) { return; }; alert(x); alert( x.responseText );}; try {x.send(null); } catch (e) { alert(e)}; alert("ok"); ');

它在 Firefox 中失败。而且我还没有在 MSIE 中测试过它。但是

测试:

(失败)来自 http://stackoverflow.com:80 的 Chrome 7(控制台)

>>> x = window.open('http://google.com', 'fds', 'width=200, height=300')
>>> x.document.body.innerHTML='test';
TypeError: Cannot read property 'body' of undefined

(成功)Chrome 7(控制台)来自 http://stackoverflow.com:80

>>> x = window.open('http://stackoverflow.com', 'fds', 'width=200, height=300')
>>> x.document.body.innerHTML='test';
"test"

(失败)来自 http://stackoverflow.com:80 的 Firefox 3.6(控制台)

>>> x = window.open('http://google.com', 'fds', 'width=200, height=300')
>>> x.document.body.innerHTML='test';
Permission denied for <http://stackoverflow.com> to get property Window.document from <http://www.google.com>.

(成功)Firefox 3.6(控制台)来自http://stackoverflow.com:80

>>> x = window.open('http://stackoverflow.com', 'fds', 'width=200, height=300')
>>> x.document.body.innerHTML='test';
"test"

(失败)来自 http://stackoverflow.com:80 的 Firefox 3.6(控制台)

$.ajax({
   url:'http://bing.com',
   success:function(data) {
      alert(data) // blank alert
   }
})

(成功)Firefox 3.6(控制台)来自http://stackoverflow.com:80

$.ajax({
   url:'http://stackoverflow.com',
   success:function(data) {
      alert(data) // success
   }
})

关于javascript - 当 URL 设置为运行 JavaScript 时，同域策略如何适用于弹出窗口？，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/4147701/