[ 9 posts ]

Lewis Valentine

  • Username: lewisvalentine
  • Joined: Sat Feb 04, 2012 9:59 am
  • Posts: 20
  • Offline
  • Profile

security violation

Post Posted: Tue May 01, 2012 1:32 pm
+0-
I am trying to rewrite some old javascript code into yui3.

I am trying to post data from a form to another page in another domain.
My original javascript

var xmlHttpReq = false;
var self = this;

// get the xml http object
if (window.XMLHttpRequest)
self.xmlHttpReq = new XMLHttpRequest(); // Mozilla/Safari/Ie7
else if (window.ActiveXObject)
self.xmlHttpReq = new ActiveXObject("Microsoft.XMLHTTP"); // older IE

// create the request
self.xmlHttpReq.open('POST', strURL, false);
self.xmlHttpReq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');

self.xmlHttpReq.onreadystatechange = function()
{
if (self.xmlHttpReq.readyState == 4)
updatepage(self.xmlHttpReq.responseText, responsediv);
else
updatepage(responsemsg,responsediv);
}

// send the request
var txt = getquerystring(formname);
self.xmlHttpReq.send(txt);


here is my yui3 code

YUI().use('node', 'event', 'io', 'io-xdr',
function (Y) {
var div_res = Y.one("#MyResult");
div_res.setContent("submit");

//Configure the cross-domain transport:
var xdrConfig = {
id:'flash',
src:'io.swf'
};
Y.io.transport(xdrConfig);

function post_success(id, o) {
alert('success');
}
function post_failure(id, o) {
alert('failure');
div_res.setContent(o.status + " " + o.statusText);
}


Y.one("#Submit1").on("click", function (e) {
var sUrl = "http://anotherdomain.com/page.php";

var req = Y.io(sUrl, {
method: 'POST',
sync: true,
xdr: { use:'flash' },
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
form: { id: 'myform' },
on: {
success:post_success,
failure:post_failure
}
});

e.preventDefault();
e.stopPropagation();
});
}


I am getting a security violation on the yui3 code.
I am a newbie to both yui and ajax.

Am I doing anything wrong? What am i missing?

Allen Rabinovich

YUI Developer

  • YUI Developer
  • Offline
  • Profile
Tags:

Re: security violation

Post Posted: Tue May 01, 2012 3:36 pm
+0-
What type of security violation are you getting? If you are using flash as a transport, the target domain needs to have a crossdomain.xml file that looks something like this: http://weather.yahooapis.com/crossdomain.xml (the allowed domains can be modified depending on how you want to limit access, but should include at least the domain where io.swf is hosted).

Lewis Valentine

  • Username: lewisvalentine
  • Joined: Sat Feb 04, 2012 9:59 am
  • Posts: 20
  • Offline
  • Profile

Re: security violation

Post Posted: Wed May 02, 2012 7:10 am
+0-
I don't know, the reply message just says 0 Security Violation

I don't know if i even need to use flash for this either. I am just mimicking a form submit to a page on another domain.

How can i tell what else i need to do?
The code on the top worked in firefox, but not in ie. I just need to get it working in both.

Allen Rabinovich

YUI Developer

  • YUI Developer
  • Offline
  • Profile
Tags:

Re: security violation

Post Posted: Wed May 02, 2012 1:20 pm
+0-
Just so I better understand the problem: at what point does the security violation occur? Does the success event ever fire, or failure? I am trying to figure out if the security violation is something that the server is reporting, or something that occurs entirely because of browser security restrictions.

Is it possible for you to post the code somewhere with the actual URL of the server you are submitting the data to, so I can try to observe the error?

Lewis Valentine

  • Username: lewisvalentine
  • Joined: Sat Feb 04, 2012 9:59 am
  • Posts: 20
  • Offline
  • Profile

Re: security violation

Post Posted: Wed May 02, 2012 1:35 pm
+0-
The failure event fires, and it is the one that displays the message.

The error is probably that the remote server does not allow cross domain postings. But that leaves the issue, i would like to do the same thing as a form submit button would do ( i even have the form ). But the form action points to a remote server. ( if i press a submit button on the form it works just fine )

Do i need cross domain flash to do that? I personally don't think so ( if form.submit does it, why can't i just do the same thing in javascript/ajax.) maybe i am way off base here and my newbie status is showing.

As far as posting the url i would rather not. It will need some private fields for it to work anyway.

Allen Rabinovich

YUI Developer

  • YUI Developer
  • Offline
  • Profile

Re: security violation

Post Posted: Wed May 02, 2012 3:11 pm
+0-
The security demands from a form posting and a same-page data submission are different. Think of it this way: when you submit a regular HTTP form, the page that it was submitted from cannot get the results back -- the results come back directly to the user. So the security of that data is never compromised, even if the form is submitted by a malicious entity. With a crossdomain same-page submission, however, the page that submits the data gets the results back, and thus the target server must give explicit permission to the submitting page to do so.

So, yes, you will need the crossdomain.xml file in the root of your server to accomplish this. Try using the same one as here: http://weather.yahooapis.com/crossdomain.xml and see if it fixes your security violation. Then change the 'domain' attribute of the allow-access-from property to the domain that's hosting io.swf (that's more secure than '*', although you still need to ensure that that domain cannot host a page that might have malicious intents), and see if it continues to work.

Allen Rabinovich

YUI Developer

  • YUI Developer
  • Offline
  • Profile

Re: security violation

Post Posted: Wed May 02, 2012 3:13 pm
+0-
Just to clarify, the crossdomain.xml needs to be in the root of the server receiving the form submission. So you should have:

mydomain.com/io.swf <-- where your io.swf is hosted

anotherdomain.com/crossdomain.xml <-- anotherdomain.com/someurl.php is where your request is being sent, and crossdomain.xml would contain <allow-access-from domain="mydomain.com">

Lewis Valentine

  • Username: lewisvalentine
  • Joined: Sat Feb 04, 2012 9:59 am
  • Posts: 20
  • Offline
  • Profile

Re: security violation

Post Posted: Thu May 03, 2012 4:45 am
+0-
I guess there is the problem. I don't have any control over the foreign site.

I really don't care about any return data at all. ( other than it was sent or not )
Is there any way to fake a normal form submission?

Allen Rabinovich

YUI Developer

  • YUI Developer
  • Offline
  • Profile
Tags:

Re: security violation

Post Posted: Thu May 03, 2012 6:05 pm
+0-
You can load the foreign site with the appropriate GET variables in a hidden iframe. You won't be able to access the content returned for security reasons, so unfortunately you won't know if the submission was successful.

Another possible way to do that is via your own server-side proxy. That may have other security implications, so tread carefully.
  [ 9 posts ]
Display posts from previous:  Sort by  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum