Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Can I disable SOP (Same Origin Policy) on any browser for development?

I want to develop JavaScript on my Windows machine. Do you know a browser where I can turn off Same Origin Policy so I can develop locally? Firefox would be optimal.

Or if you know a proxy I could use for a SOAP/WSDL site it would be great too.

I am trying to work with the JavaSCript SOAP Client.

like image 393
Thomaschaaf Avatar asked Dec 01 '08 10:12

Thomaschaaf


People also ask

Is there any way to disable the same-origin policy on Google's chrome browser?

In Google Chrome, you can easily disable the same-origin policy of Chrome by running Chrome with the following command: [your-path-to-chrome-installation-dir]\chrome.exe --disable-web-security --user-data-dir . Make sure that all instances of Chrome are closed before you run the command.

Why do we need same-origin policy for the web?

The same-origin policy is a critical security mechanism that restricts how a document or script loaded by one origin can interact with a resource from another origin. It helps isolate potentially malicious documents, reducing possible attack vectors.

Is same-origin policy enabled by default?

Hence the name same-origin policy. The same-origin policy is active by default and most browsers provide good error messages when actions cannot be executed because of same-origin policy issues. For instance, the following script defines an illegal cross-origin HTTP request.

How do I turn off my CORS policy?

Show activity on this post. I find the best way to do this is duplicate a Chrome or Chrome Canary shortcut on your windows desktop. Rename this shortcut to "NO CORS" then edit the properties of that shortcut. in the target add --disable-web-security --user-data-dir="D:/Chrome" to the end of the target path.


2 Answers

UPDATE 6/2012: This used to work at the time of the writing, but obviously no more. Sorry.

In Firefox (might apply to other Gecko-based browsers as well) you can use the following JavaScript snippet to allow cross-domain calls:

if (navigator.userAgent.indexOf("Firefox") != -1) {     try {         netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");     }      catch (e) {         alert("Permission UniversalBrowserRead denied -- not running Mozilla?");     } } 

It looks like there's an issue created in the Chromium issue tracker for achieving the same functionality, so you could try starting Chrome with the argument --disable-web-security. I don't know which builds this works on exactly, but at least Nokia's WRT Tools comes with a Chrome installation that does in fact allow loading content from other sites.

like image 93
miek Avatar answered Oct 07 '22 16:10

miek


Unfortunately, using the following:

netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead"); 

has been disabled in Firefox 5.

https://bugzilla.mozilla.org/show_bug.cgi?id=667312

like image 35
user828878 Avatar answered Oct 07 '22 15:10

user828878