原始文献 / 论坛帖 / Re: URI-scheme for bitcoin
Re: URI-scheme for bitcoin
Bitcointalk · 2010-07-18 16:06:16 UTC
引用自：lachesis 于 June 16, 2010, 06:14:05 AM（https://bitcointalk.org/index.php?topic=55.msg1597#msg1597）
我觉得你误解了问题。我的浏览器永远能访问 127.0.0.1（除非有什么奇怪的 IE 设置或病毒）。如果我在地址栏输入地址或点链接，都能正常工作。但没法用 Javascript 在不同域之间（或同一域的不同端口之间）完成 POST 请求。
我也是这么想的。
引用自：sirius-m 于 June 16, 2010, 08:26:14 AM（https://bitcointalk.org/index.php?topic=55.msg1598#msg1598）
对，我是想说跨域 javascript 调用是被禁止的，所以你不能从一个不在 127.0.0.1 上的 javascript 去调用 127.0.0.1。想想看，如果浏览器允许恶意的跨域 javascript 去改别人的 Facebook 页面，那就太好笑了。
现在我听说 javascript 是可以向 127.0.0.1 做跨域 POST 请求的。不是别的域，唯独就是这一个。可以……
如果是这样，那就不要在你用来上网的系统上用 -server 开关或 bitcoind。
我这就开始加密码字段。
英文原文
Quote from: lachesis on June 16, 2010, 06:14:05 AM（https://bitcointalk.org/index.php?topic=55.msg1597#msg1597）
I think you're misunderstanding the issue. My browser will always be able to go to 127.0.0.1 (barring some strange IE settings or a virus). If I type the address into the URL bar or click a link, it will work fine. However, it isn't possible to use Javascript to complete POST requests between domains (or ports on the same domain).
That's what I thought too.
Quote from: sirius-m on June 16, 2010, 08:26:14 AM（https://bitcointalk.org/index.php?topic=55.msg1598#msg1598）
Yeah, I meant to say that cross-domain javascript calls are forbidden, so you can't call 127.0.0.1 from a javascript that doesn't reside in 127.0.0.1. Come to think of it, it would be quite funny if browsers allowed malicious cross-domain javascript to change people's Facebook pages etc.
Now I'm hearing a report that it IS possible for javascript to do a cross-domain POST request to 127.0.0.1. Not other domains, but just specifically to that one. Great...
If this is the case, then do not use the -server switch or bitcoind on a system where you do web browsing.
I'll get started on adding the password field.