While parsing a web page, I need to initiate an AJAX call to my localhost depending on the content. The purpose is to exchange data using a PHP script on my localhost, possibly in JSON format (still under testing).
This process is part of a plugin that I am currently testing on Google's page.
I am following a simple AJAX example from:
https://www.w3schools.com/xml/ajax_xmlhttprequest_response.asp
I have successfully managed to make the AJAX call itself.
//loadDoc("http://localhost/index.php", myCallback); <-- this NOT
//loadDoc("https://www.google.de", myCallback); <-- this WORKS
/*
Content Security Policy: Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified (unknown)
Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified (unknown)
Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified
*/
function loadDoc(url, cFunction) {
var xhttp;
xhttp=new XMLHttpRequest();
xhttp.onreadystatechange = function() {
if (this.readyState == 4 && this.status == 200) {
cFunction(this);
}
};
xhttp.open("GET", url, true);
xhttp.send();
}
function myCallback(xhttp) {
alert("I'm alive from my local server");
}
The main issue I encountered is that the "Content Security Policy" does not permit cross-domain calls even within my own context (my browser, FF 53).
It seems that this restriction can be bypassed for GET requests by injecting a script into the DOM, as demonstrated in this article:
AJAX cross domain call
and especially with the insights shared by Rob W in this post:
Insert code into the page context using a content script
Despite trying out this approach, I still encounter issues.
// var actualCode = ['/* Code here. Example: */' + 'alert(0);',
// '// Beware! This array have to be joined',
// '// using a newline. Otherwise, missing semicolons',
// '// or single-line comments (//) will mess up your',
// '// code ----->'].join('\n');
var script = document.createElement('script');
script.src = "http://localhost/index.php";
script.type = "text/javascript";
document.appendChild(script);
// script.textContent = actualCode;
// (document.head||document.documentElement).appendChild(script);
// script.remove();
Since I am only using my localhost, security concerns are not a priority. Can anyone point out what I might be missing here?
EDITED
The errors displayed by Firefox debugger are highlighted below:
Blocked loading mixed active content “http://localhost/index.php”[Learn More] axtest.js:16
Content Security Policy: Ignoring “'unsafe-inline'” within script-src: ‘strict-dynamic’ specified (unknown)
Content Security Policy: Ignoring “https:” within script-src: ‘strict-dynamic’ specified (unknown)
Content Security Policy: Ignoring “http:” within script-src: ‘strict-dynamic’ specified