Getting JSONP response inside a javascript: URL

Question

This code works:

(function() {
        var scr = document.createElement('script');
        var head = document.getElementsByTagName('head')[0];
        window.insert = function(data) {
                alert(data);
        };
        scr.src = 'http://nocore.info/test.php?callback=insert';
        scr.type = 'text/javascript';
        head.appendChild(scr);
})();

It's tested using jsFiddle. What it does is it gets a string via JSONp and alerts it.

And so does this code:

(function(){var a=document.createElement("script"),b=document.getElementsByTagName("head")[0];window.insert=function(a){alert(a)};a.src="http://nocore.info/test.php?callback=insert";a.type="text/javascript";b.appendChild(a)})();

But when I type javascript: in the URL bar followed by this code, I get nothing. Why exactly is this? I'm not aware of any such behavior. I can set window.* variables in the URL bar and I can manipulate DOM.

So what's the problem here guys?

Thanks guys. Appreciate your help.

It's working. I got an alert says "This is a test" and an script tag in <head/> — lastr2d2
– lastr2d2, Commented Oct 30, 2013 at 7:52

lastr2d2 · Accepted Answer · 2013-10-31 03:10:09Z

It just doesn't work when you're on Google. I've tried it on a different page and it works.

It works on Google too. You can found a <script> tag in <head/>. However, there is no alert window popping up. That's because:

Can someone please explain why this is?

Google is using https, and if your website delivers HTTPS pages, all active mixed content delivered via HTTP on this pages will be blocked by default. in Chrome and Firefox (haven't tested other browsers.)

That means, if your site runs on Secure SSL, the browse will block some insecure content from external http sources. In your case, that's http://nocore.info/test.php?callback=insert. Open you console panel, you will see an error/warnning like this:

[blocked] The page at https://www.google.com/ ran insecure content from http://nocore.info/test.php?callback=insert.

How to fix:

Use another host that supports Secure SSL. https://yournewhost/test.php?callback=insert will work. If we are talking about some common javascript library, use a CDN such as Google, Microsoft that support https.
Take Chrome for example, disable insecure content check by using a command line parameter for Chrome called "-allow-running-insecure-content". [NOT RECOMMEND]

About mixed content and how to view it - Knowledge Base

Vincent · Accepted Answer · 2013-10-30 16:52:05Z

0

OK, apparently @Wayne is right. It just doesn't work when you're on Google. I've tried it on a different page and it works. Can someone please explain why this is? How is their JavaScript able to 'disarm' this code?

answered Oct 30, 2013 at 16:52

Vincent

2,4241 gold badge18 silver badges23 bronze badges

Collectives™ on Stack Overflow

Getting JSONP response inside a javascript: URL

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related