Questions about cross-domain access between AJax and Jsonp-JS Tutorial-php.cn

Home

Web Front-end

JS Tutorial

Questions about cross-domain access between AJax and Jsonp

不言

Jul 02, 2018 pm 03:37 PM

ajax javascript jsonp Cross-domain access

This article gives you a summary of JavaScript's AJax, JQuery's AJax and the use of jsonp to achieve cross-domain access. It is very detailed and comprehensive. Friends in need can refer to it.

#JavaScript's AJax

AJAX is "Asynchronous Javascript And XML" (Asynchronous JavaScript and XML)
Design AJax to use An important technology is the XMLHttpRequest object.

How to create an XMLHttpRequest object:

xmlhttp = new ActiveObject("Microsoft.XMLHTTP"); // Creation method supported by IE browser
xmlhttp = new XMLHTTPRequest( ); // Creation methods supported by browsers such as FireFox and Opera
XMLHttp is a set of APIs that can transmit or receive XML and other data through the http protocol in scripting languages such as Javascript, VbScript, and Jscript. Can be used to simulate http GET and POST requests.
You can determine whether the window.XMLHttpRequest object is available and then create an XMLHttpRequest object.

The following are the properties and usage methods of the XMLHttpRequest object. They are pasted and commented in detail.

<html> 
<head> 
<title>XMLHTTPRequest对象的说明DEMO</title> 
<script language="javascript" type="text/javascript"> 
<!-- 
var xmlhttp; 
// 创建一个XMLHTTPRequest对象 
function createXMLHTTPRequext(){ 
  if(window.ActiveXObject) { 
    xmlhttp = new ActiveXObject(&#39;Microsoft.XMLHTTP&#39;); 
  } 
  else if(window.XMLHTTPRequest){ 
    xmlhttp = new XMLHTTPRequest(); 
  } 
} 
function PostOrder(xmldoc) 
{ 
  createXMLHTTPRequext(); 

  // 方法：open 
  // 创建一个新的http请求，并指定此请求的方法、URL以及验证信息 
  // 语法：oXMLHttpRequest.open(bstrMethod, bstrUrl, varAsync, bstrUser, bstrPassword); 
  // 参数 
  // bstrMethod 
  // http方法，例如：POST、GET、PUT及PROPFIND。大小写不敏感。 
  // bstrUrl 
  // 请求的URL地址，可以为绝对地址也可以为相对地址。 
  // varAsync[可选] 
  // 布尔型，指定此请求是否为异步方式，默认为true。如果为真，当状态改变时会调用onreadystatechange属性指定的回调函数。 
  // bstrUser[可选] 
  // 如果服务器需要验证，此处指定用户名，如果未指定，当服务器需要验证时，会弹出验证窗口。 
  // bstrPassword[可选] 
  // 验证信息中的密码部分，如果用户名为空，则此值将被忽略。 
  // 备注：调用此方法后，可以调用send方法向服务器发送数据。 
  xmlhttp.Open("get", "http://localhost/example.htm", false); 
  // var book = xmlhttp.responseXML.selectSingleNode("//book[@id=&#39;bk101&#39;]"); 
  // alert(book.xml); 

  // 属性：onreadystatechange 
  // onreadystatechange：指定当readyState属性改变时的事件处理句柄 
  // 语法：oXMLHttpRequest.onreadystatechange = funcMyHandler; 
  // 如下的例子演示当XMLHTTPRequest对象的readyState属性改变时调用HandleStateChange函数， 
  // 当数据接收完毕后（readystate == 4）此页面上的一个按钮将被激活 
  // 备注：此属性只写，为W3C文档对象模型的扩展. 
  xmlhttp.onreadystatechange= HandleStateChange; 

  // 方法：send 
  // 发送请求到http服务器并接收回应 
  // 语法：oXMLHttpRequest.send(varBody); 
  // 参数：varBody （欲通过此请求发送的数据。） 
  // 备注：此方法的同步或异步方式取决于open方法中的bAsync参数，如果bAsync == False，此方法将会等待请求完成或者超时时才会返回，如果bAsync == True，此方法将立即返回。 
  // This method takes one optional parameter, which is the requestBody to use. The acceptable VARIANT input types are BSTR, SAFEARRAY of UI1 (unsigned bytes), IDispatch to an XML Document Object Model (DOM) object, and IStream *. You can use only chunked encoding (for sending) when sending IStream * input types. The component automatically sets the Content-Length header for all but IStream * input types. 
  // 如果发送的数据为BSTR，则回应被编码为utf-8, 必须在适当位置设置一个包含charset的文档类型头。 
  // If the input type is a SAFEARRAY of UI1, the response is sent as is without additional encoding. The caller must set a Content-Type header with the appropriate content type. 
  // 如果发送的数据为XML DOM object，则回应将被编码为在xml文档中声明的编码，如果在xml文档中没有声明编码，则使用默认的UTF-8。 
  // If the input type is an IStream *, the response is sent as is without additional encoding. The caller must set a Content-Type header with the appropriate content type. 

  xmlhttp.Send(xmldoc); 

  // 方法：getAllResponseHeaders 
  // 获取响应的所有http头 
  // 语法：strValue = oXMLHttpRequest.getAllResponseHeaders(); 
  // 备注：每个http头名称和值用冒号分割，并以\r\n结束。当send方法完成后才可调用该方法。 
  alert(xmlhttp.getAllResponseHeaders()); 
  // 方法：getResponseHeader 
  // 从响应信息中获取指定的http头 
  // 语法：strValue = oXMLHttpRequest.getResponseHeader(bstrHeader); 
  // 备注：当send方法成功后才可调用该方法。如果服务器返回的文档类型为"text/xml", 则这句话 
  // xmlhttp.getResponseHeader("Content-Type");将返回字符串"text/xml"。可以使用getAllResponseHeaders方法获取完整的http头信息。 
  alert(xmlhttp.getResponseHeader("Content-Type")); // 输出http头中的Content-Type列：当前web服务器的版本及名称。 

  document.frmTest.myButton.disabled = true; 

  // 方法：abort 
  // 取消当前请求 
  // 语法：oXMLHttpRequest.abort(); 
  // 备注：调用此方法后，当前请求返回UNINITIALIZED 状态。 
  // xmlhttp.abort(); 

  // 方法：setRequestHeader 
  // 单独指定请求的某个http头 
  // 语法：oXMLHttpRequest.setRequestHeader(bstrHeader, bstrValue); 
  // 参数：bstrHeader（字符串，头名称。） 
  // bstrValue（字符串，值。） 
  // 备注：如果已经存在已此名称命名的http头，则覆盖之。此方法必须在open方法后调用。 
  // xmlhttp.setRequestHeader(bstrHeader, bstrValue); 
  } 
  function HandleStateChange() 
  { 
  // 属性：readyState 
  // 返回XMLHTTP请求的当前状态 
  // 语法：lValue = oXMLHttpRequest.readyState; 
  // 备注：变量，此属性只读，状态用长度为4的整型表示.定义如下： 
  // 0 (未初始化) 对象已建立，但是尚未初始化（尚未调用open方法） 
  // 1 (初始化) 对象已建立，尚未调用send方法 
  // 2 (发送数据) send方法已调用，但是当前的状态及http头未知 
  // 3 (数据传送中) 已接收部分数据，因为响应及http头不全，这时通过responseBody和responseText获取部分数据会出现错误， 
  // 4 (完成) 数据接收完毕,此时可以通过通过responseBody和responseText获取完整的回应数据 
  if (xmlhttp.readyState == 4){ 
    document.frmTest.myButton.disabled = false; 

    // 属性：responseBody 
    // 返回某一格式的服务器响应数据 
    // 语法：strValue = oXMLHttpRequest.responseBody; 
    // 备注：变量，此属性只读，以unsigned array格式表示直接从服务器返回的未经解码的二进制数据。 
    alert(xmlhttp.responseBody); 

    // 属性：responseStream 
    // 以Ado Stream对象的形式返回响应信息 
    // 语法：strValue = oXMLHttpRequest.responseStream; 
    // 备注：变量，此属性只读，以Ado Stream对象的形式返回响应信息。 
    alert(xmlhttp.responseStream); 

    // 属性：responseText 
    // 将响应信息作为字符串返回 
    // 语法：strValue = oXMLHttpRequest.responseText; 
    // 备注：变量，此属性只读，将响应信息作为字符串返回。XMLHTTP尝试将响应信息解码为Unicode字符串， 
    // XMLHTTP默认将响应数据的编码定为UTF-8，如果服务器返回的数据带BOM(byte-order mark)，XMLHTTP可 
    // 以解码任何UCS-2 (big or little endian)或者UCS-4 数据。注意，如果服务器返回的是xml文档，此属 
    // 性并不处理xml文档中的编码声明。你需要使用responseXML来处理。 
    alert(xmlhttp.responseText); 

    // 属性：responseXML 
    // 将响应信息格式化为Xml Document对象并返回 
    // 语法：var objDispatch = oXMLHttpRequest.responseXML; 
    // 备注：变量，此属性只读，将响应信息格式化为Xml Document对象并返回。如果响应数据不是有效的XML文档， 
    // 此属性本身不返回XMLDOMParseError，可以通过处理过的DOMDocument对象获取错误信息。 
    alert("Result = " + xmlhttp.responseXML.xml); 

    // 属性：status 
    // 返回当前请求的http状态码 
    // 语法：lValue = oXMLHttpRequest.status; 
    // 返回值：长整形标准http状态码，定义如下： 
    // Number:Description 
    // 100:Continue
    // 101:Switching protocols 
    // 200:OK 
    // 201:Created 
    // 202:Accepted 
    // 203:Non-Authoritative Information 
    // 204:No Content 
    // 205:Reset Content 
    // 206:Partial Content 
    // 300:Multiple Choices 
    // 301:Moved Permanently 
    // 302:Found 
    // 303:See Other 
    // 304:Not Modified 
    // 305:Use Proxy 
    // 307:Temporary Redirect 
    // 400:Bad Request 
    // 401:Unauthorized 
    // 402:Payment Required 
    // 403:Forbidden 
    // 404:Not Found 
    // 405:Method Not Allowed 
    // 406:Not Acceptable 
    // 407:Proxy Authentication Required 
    // 408:Request Timeout 
    // 409:Conflict 
    // 410:Gone 
    // 411:Length Required 
    // 412:Precondition Failed 
    // 413:Request Entity Too Large 
    // 414:Request-URI Too Long 
    // 415:Unsupported Media Type 
    // 416:Requested Range Not Suitable 
    // 417:Expectation Failed 
    // 500:Internal Server Error 
    // 501:Not Implemented 
    // 502:Bad Gateway 
    // 503:Service Unavailable 
    // 504:Gateway Timeout 
    // 505:HTTP Version Not Supported 
    // 备注：长整形，此属性只读，返回当前请求的http状态码,此属性仅当数据发送并接收完毕后才可获取。 
    alert(xmlhttp.status);

    // 属性：statusText 
    // 返回当前请求的响应行状态 
    // 语法：strValue = oXMLHttpRequest.statusText; 
    // 备注：字符串，此属性只读，以BSTR返回当前请求的响应行状态,此属性仅当数据发送并接收完毕后才可获取。 
    alert(xmlhttp.statusText); 
  } 
} 

//--> 
</script> 
</head> 
<body> 
  <form name="frmTest"> 
    <input name="myButton" type="button" value="Click Me" onclick="PostOrder(&#39;http://localhost/example.htm&#39;);"> 
  </form> 
</body> 
</html>

Copy after login

To put it simply, it is a process of using the XMLHttpRequest object to make a request to the server, and then getting the information returned by the server.

The above is JavaScript Ajax technology principles. It is completely different from the principle of Jsonp implementing cross-domain access that will be discussed later.

JQuery’s AJax

JQuery encapsulates the ajax technology, making it more convenient to use.

$.General form of ajax

$.ajax({
  type: &#39;POST&#39;,
  url: url ,
  data: data ,
  dataType: dataType
  success: success ,  
});

Copy after login

When the scene is different, we need to use Ajax instead. 1. Assemble json data. 2. Serialize table content. var formParam = $("#form1").serialize(); 3. Splice URLs. . . For example, when there are special strings (such as &) in our data, string splicing is not easy to use, which may make the submitted content incomplete. At this time, it will be easier to use Json.

Using jsonp to achieve cross-domain access

What is Jsonp? What does

have to do with json?

How does jsonp achieve cross-domain access?

First explain why Ajax cannot be accessed across domains and why browsers restrict cross-domain access.

Assuming that the browser supports cross-domain access, we can access site B through XmlHttpRequest at site A. At this time, we have passed the verification of site B and obtained the cookie of site B. Then we can freely When you visit site B, site A can impersonate site B to perform all operations on site B that do not require further verification. This is quite dangerous.

How do we obtain cross-domain data?

We found that when calling js files on a Web page, it is not affected by whether it is cross-domain (not only that, we also found that all tags with the "src" attribute have cross-domain capabilities, such as script, img, iframe, etc. We can use this property of js to get the data we want.

In order to facilitate the client to use data, an informal transmission protocol has gradually formed, People call it JSONP. One of the key points of this protocol is to allow users to pass a callback parameter to the server. Then when the server returns data, it will use this callback parameter as a function name to wrap the JSON data, so that the client can customize it at will. Use your own function to automatically process the returned data.

Let’s take a look at what jsonp does.

1. We know that even cross-domain js files The code in (of course it complies with the web script security policy), the web page can also be executed unconditionally. There is a remote.js file in the root directory of the remote server remoteserver.com, the code is as follows:

alert('I am Remote file');

The local server localserver.com has a jsonp.html page code as follows:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title></title>
  <script type="text/javascript" src="http://remoteserver.com/remote.js"></script>
</head>
<body>
</body>
</html>

Copy after login

There is no doubt that the page will pop up A prompt form shows that the cross-domain call is successful. This is the most basic idea of jsonp.

2. Now we define a function on the jsonp.html page, and then pass in the data in the remote remote.js. Call. The jsonp.html page code is as follows:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title></title>
  <script type="text/javascript">
  var localHandler = function(data){
    alert(&#39;我是本地函数，可以被跨域的remote.js文件调用，远程js带来的数据是：&#39; + data.result);
  };
  </script>
  <script type="text/javascript" src="http://remoteserver.com/remote.js"></script>
</head>
<body>
</body>
</html>

Copy after login

remote.js file code is as follows:

localHandler({"result":"I It is the data brought by the remote js"});

Check the results after running. The page successfully pops up a prompt window, showing that the local function was successfully called by the cross-domain remote js, and the data brought by the remote js was also received. Cross-domain The purpose of accessing the data has been achieved, but how do I let the remote js know the name of the local function it should call?

3. You can pass a parameter to tell the server "I want to call the XXX function in a section js code, please return it to me", so the server can generate the js script according to the client's needs and respond.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title></title>
  <script type="text/javascript">
  // 得到航班信息查询结果后的回调函数
  var flightHandler = function(data){
    alert(&#39;你查询的航班结果是：票价 &#39; + data.price + &#39; 元，&#39; + &#39;余票 &#39; + data.tickets + &#39; 张。&#39;);
  };
  // 提供jsonp服务的url地址（不管是什么类型的地址，最终生成的返回值都是一段javascript代码）
  var url = "http://flightQuery.com/jsonp/flightResult.aspx?code=CA1998&callback=flightHandler";
  // 创建script标签，设置其属性
  var script = document.createElement(&#39;script&#39;);
  script.setAttribute(&#39;src&#39;, url);
  // 把script标签加入head，此时调用开始
  document.getElementsByTagName(&#39;head&#39;)[0].appendChild(script);
  </script>
</head>
<body>
</body>
</html>

Copy after login

On the server side, We get the callback and assemble the required js.

String callback = request.getParemeter("callback");

response.getWriter.print(callback "(" json ")");

The content returned to the page is:

flightHandler({
  "code": "CA1998",
  "price": 1780,
  "tickets": 5
});

Copy after login

4.Jquery also encapsulates jsonp. (The form is more like ajax)

###

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" >
 <head>
   <title>Untitled Page</title>
   <script type="text/javascript" src=jquery.min.js"></script>
   <script type="text/javascript">
   jQuery(document).ready(function(){
    $.ajax({
       type: "get",
       async: false,
       url: "http://flightQuery.com/jsonp/flightResult.aspx?code=CA1998",
       dataType: "jsonp",
       jsonp: "callback",//传递给请求处理程序或页面的，用以获得jsonp回调函数名的参数名(一般默认为:callback)
       jsonpCallback:"flightHandler",//自定义的jsonp回调函数名称，默认为jQuery自动生成的随机函数名，也可以写"?"，jQuery会自动为你处理数据
       success: function(json){
         alert(&#39;您查询到航班信息：票价： &#39; + json.price + &#39; 元，余票： &#39; + json.tickets + &#39; 张。&#39;);
       },
       error: function(){
         alert(&#39;fail&#39;);
       }
     });
   });
   </script>
   </head>
 <body>
 </body>
 </html>

Copy after login

######

最后申明，Ajax和jsonp是两个完全不一样的东西。 ajax的核心是通过XmlHttpRequest获取非本页内容，而jsonp的核心则是动态添加script标签来调用服务器提供的js脚本。

在jQuery中如何通过JSONP来跨域获取数据

第一种方法是在ajax函数中设置dataType为'jsonp'：

$.ajax({
    dataType: &#39;jsonp&#39;,
    jsonp:&#39;callback&#39;,
    url: &#39;http://www.a.com/user?id=123&#39;,   
    success: function(data){   
        //处理data数据   
    }   
});

Copy after login

第二种方法是利用getJSON来实现，只要在地址中加上callback=?参数即可：

$.getJSON(&#39;http://www.a.com/user?id=123&callback=?&#39;, function(data){   
    //处理data数据   
});

Copy after login

也可以简单地使用getScript方法：

//此时也可以在函数外定义foo方法   
function foo(data){   
    //处理data数据   
}   
$.getJSON(&#39;http://www.a.com/user?id=123&callback=foo&#39;);

Copy after login

JSONP的应用

JSONP在开放API中可以起到非常重要的作用，开放API是运用在开发者自己的应用上，而许多应用往往是在开发者的服务器上而不是在新浪微博的服务器上，因此跨域请求数据成为开发者们所需要解决的一大问题，广大开放平台应该实现对JSONP的支持，这一点新浪微博开放平台便做的非常好（虽然某些API里没有说明，但实际上是可以使用JSONP方式调用的）。

以上就是本文的全部内容，希望对大家的学习有所帮助，更多相关内容请关注PHP中文网！

Hot AI Tools

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress images for free

Clothoff.io

AI clothes remover

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Assassin's Creed Shadows: Seashell Riddle Solution

1 months ago By DDD

What's New in Windows 11 KB5054979 & How to Fix Update Issues

3 weeks ago By DDD

Where to find the Crane Control Keycard in Atomfall

1 months ago By DDD

How to fix KB5055523 fails to install in Windows 11?

2 weeks ago By DDD

InZoi: How To Apply To School And University

3 weeks ago By DDD

Hot Tools

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Hot Topics

Where is the login entrance for gmail email?

7750

Java Tutorial

1643

CakePHP Tutorial

1397

Laravel Tutorial

1293

PHP Tutorial

1234

Related knowledge

How to solve the 403 error encountered by jQuery AJAX request Feb 20, 2024 am 10:07 AM

Title: Methods and code examples to resolve 403 errors in jQuery AJAX requests. The 403 error refers to a request that the server prohibits access to a resource. This error usually occurs because the request lacks permissions or is rejected by the server. When making jQueryAJAX requests, you sometimes encounter this situation. This article will introduce how to solve this problem and provide code examples. Solution: Check permissions: First ensure that the requested URL address is correct and verify that you have sufficient permissions to access the resource.

How to solve jQuery AJAX request 403 error Feb 19, 2024 pm 05:55 PM

jQuery is a popular JavaScript library used to simplify client-side development. AJAX is a technology that sends asynchronous requests and interacts with the server without reloading the entire web page. However, when using jQuery to make AJAX requests, you sometimes encounter 403 errors. 403 errors are usually server-denied access errors, possibly due to security policy or permission issues. In this article, we will discuss how to resolve jQueryAJAX request encountering 403 error

PHP and Ajax: Building an autocomplete suggestion engine Jun 02, 2024 pm 08:39 PM

Build an autocomplete suggestion engine using PHP and Ajax: Server-side script: handles Ajax requests and returns suggestions (autocomplete.php). Client script: Send Ajax request and display suggestions (autocomplete.js). Practical case: Include script in HTML page and specify search-input element identifier.

How to solve the problem of jQuery AJAX error 403? Feb 23, 2024 pm 04:27 PM

How to solve the problem of jQueryAJAX error 403? When developing web applications, jQuery is often used to send asynchronous requests. However, sometimes you may encounter error code 403 when using jQueryAJAX, indicating that access is forbidden by the server. This is usually caused by server-side security settings, but there are ways to work around it. This article will introduce how to solve the problem of jQueryAJAX error 403 and provide specific code examples. 1. to make

How to get variables from PHP method using Ajax? Mar 09, 2024 pm 05:36 PM

Using Ajax to obtain variables from PHP methods is a common scenario in web development. Through Ajax, the page can be dynamically obtained without refreshing the data. In this article, we will introduce how to use Ajax to get variables from PHP methods, and provide specific code examples. First, we need to write a PHP file to handle the Ajax request and return the required variables. Here is sample code for a simple PHP file getData.php:

PHP vs. Ajax: Solutions for creating dynamically loaded content Jun 06, 2024 pm 01:12 PM

Ajax (Asynchronous JavaScript and XML) allows adding dynamic content without reloading the page. Using PHP and Ajax, you can dynamically load a product list: HTML creates a page with a container element, and the Ajax request adds the data to that element after loading it. JavaScript uses Ajax to send a request to the server through XMLHttpRequest to obtain product data in JSON format from the server. PHP uses MySQL to query product data from the database and encode it into JSON format. JavaScript parses the JSON data and displays it in the page container. Clicking the button triggers an Ajax request to load the product list.

PHP and Ajax: Ways to Improve Ajax Security Jun 01, 2024 am 09:34 AM

In order to improve Ajax security, there are several methods: CSRF protection: generate a token and send it to the client, add it to the server side in the request for verification. XSS protection: Use htmlspecialchars() to filter input to prevent malicious script injection. Content-Security-Policy header: Restrict the loading of malicious resources and specify the sources from which scripts and style sheets are allowed to be loaded. Validate server-side input: Validate input received from Ajax requests to prevent attackers from exploiting input vulnerabilities. Use secure Ajax libraries: Take advantage of automatic CSRF protection modules provided by libraries such as jQuery.

Asynchronous data exchange using Ajax functions Jan 26, 2024 am 09:41 AM

How to use Ajax functions to achieve asynchronous data interaction With the development of the Internet and Web technology, data interaction between the front end and the back end has become very important. Traditional data interaction methods, such as page refresh and form submission, can no longer meet user needs. Ajax (Asynchronous JavaScript and XML) has become an important tool for asynchronous data interaction. Ajax enables the web to use JavaScript and the XMLHttpRequest object

See all articles