从 HTTPS 页面到 HTTP(非 HTTPS)本地主机地址的混合内容请求未被阻止-前端问题

Mixed-content request from HTTPS page to HTTP (non-HTTPS) localhost address not blocked(从 HTTPS 页面到 HTTP(非 HTTPS)本地主机地址的混合内容请求未被阻止)

本文介绍了从 HTTPS 页面到 HTTP(非 HTTPS)本地主机地址的混合内容请求未被阻止的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

假设下面的页面是从 https://127.0.100.1 加载的.该页面向 http://127.0.100.2 发出 XMLHttpRequest.这似乎是混合内容:页面通过安全连接加载，资源通过不安全连接加载.混合内容应被浏览器阻止.然而，下面的页面运行良好.* 为什么会运行:为什么请求没有被阻止?

Suppose the page below is loaded from https://127.0.100.1. The page makes an XMLHttpRequest to http://127.0.100.2. This seems like mixed content: The page is loaded over a secure connection and a resource is loaded over an insecure connection. Mixed content should be blocked by the browser. Yet, the page below works just fine.* Why does it work: Why isn't the request blocked?

更新:超越接受的答案，浏览器可以配置来阻止此类地址的混合内容.

Update: Going beyond the accepted answer, browsers can be configured to block mixed content for such addresses.

^{* Wireshark 确认浏览器没有通过安全连接加载资源.}

<html>
<body>
<img id="dst"/>
<script>
  let xhr = new XMLHttpRequest();
  xhr.open('get', 'http://127.0.100.2/img.jpg');
  xhr.responseType = 'blob';
  xhr.onload = function(){
    document.getElementById('dst').src = URL.createObjectURL(xhr.response);    
  }
  xhr.send();
</script>
</body>
</html>

从 HTTPS 页面到 HTTP(非 HTTPS)本地主机地址的混合内容请求未被阻止

问题描述

推荐答案

基础教程推荐