0

I'm using this code to get a value from a field in popup.

http://myotherwebsitename.com/parent.html

<input type="text" id="output"/>
<button id="show">Open</button>

<script>
    document.getElementById('show').addEventListener('click', function(){
        window['output'] = document.getElementById('output');
        window.open('http://mywebsite.com/map.html')
    });
</script>  

http://mywebsite.com/map.html

<input type="text" id="user_text"/>
<input id="send" type='button' value'send'/>

<script>
    document.getElementById('send').addEventListener('click', function(){
    window.opener['output'].value = document.getElementById('user_text').value;
})
</script>

It works well if both are hosted on the same website, but if i put one of these on other website it doesn't work.

How can i make it working for different websites?

Thanks!

2

2 Answers 2

2

Due to same origin policy you can't get info from another website. here is a better definition of why...

In computing, the same-origin policy is an important security concept for a number of browser-side programming languages, such as JavaScript. The policy permits scripts running on pages originating from the same site – a combination of scheme, hostname, and port number[1] – to access each other's DOM with no specific restrictions, but prevents access to DOM on different sites.[1] Same-origin policy also applies to XMLHttpRequest and to robots.txt.

http://en.wikipedia.org/wiki/Same-origin_policy.

hope this helps. I'll see if I can find a workaround and let you know though.

1

Yep, same origin policy...

If you have access to external site, you can grant access to your first domain by setting Access-Control-Allow-Origin header on request OPTIONS. Here PHP example:

    if (isset($_SERVER['HTTP_ORIGIN']) && in_array($_SERVER['HTTP_ORIGIN'], $allowedList))
    {
        header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
        header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
        header('Access-Control-Allow-Credentials: true');
        header('Access-Control-Max-Age: 1000');
        header('Access-Control-Allow-Headers: X-Requested-With, Content-Type');
        exit;
    }

But you should known, that HTTP_ORIGIN contains schema, and you should specify both http and https domains in $allowedList.

2
  • Yes, I have access to external site, it's mine. Nov 28, 2013 at 7:55
  • Than you should check server access logs, maybe OPTIONS denied by server configuration and so on Nov 28, 2013 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.