Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(408)

Side by Side Diff: chrome/common/extensions/docs/static/xhr.html

Issue 10826261: Extension Docs: Remove out dated version notes. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 8 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « chrome/common/extensions/docs/static/permissions.html ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 <div id="pageData-name" class="pageData">Cross-Origin XMLHttpRequest</div> 1 <div id="pageData-name" class="pageData">Cross-Origin XMLHttpRequest</div>
2 2
3 <!-- BEGIN AUTHORED CONTENT --> 3 <!-- BEGIN AUTHORED CONTENT -->
4 <p id="classSummary"> 4 <p id="classSummary">
5 Regular web pages can use the 5 Regular web pages can use the
6 <a href="http://www.w3.org/TR/XMLHttpRequest/">XMLHttpRequest</a> 6 <a href="http://www.w3.org/TR/XMLHttpRequest/">XMLHttpRequest</a>
7 object to send and receive data from remote servers, 7 object to send and receive data from remote servers,
8 but they're limited by the 8 but they're limited by the
9 <a href="http://en.wikipedia.org/wiki/Same_origin_policy">same origin policy</a> . 9 <a href="http://en.wikipedia.org/wiki/Same_origin_policy">same origin policy</a> .
10 Extensions aren't so limited. 10 Extensions aren't so limited.
11 An extension can talk to remote servers outside of its origin, 11 An extension can talk to remote servers outside of its origin,
12 as long as it first requests cross-origin permissions.</p> 12 as long as it first requests cross-origin permissions.</p>
13 13
14 <p class="note">
15 <b>Version note:</b>
16 As of Chrome 13,
17 content scripts can make cross-origin requests
18 to the same servers as the rest of the extension.
19 Before Chrome 13, a content script couldn't directly make requests;
20 instead, it had to
21 send a message to its parent extension
22 asking the extension to make a cross-origin request.
23 </p>
24
25 <h2 id="extension-origin">Extension origin</h2> 14 <h2 id="extension-origin">Extension origin</h2>
26 <p>Each running extension exists within its own separate security origin. Withou t 15 <p>Each running extension exists within its own separate security origin. Withou t
27 requesting additional privileges, the extension can use 16 requesting additional privileges, the extension can use
28 XMLHttpRequest to get resources within its installation. For example, if 17 XMLHttpRequest to get resources within its installation. For example, if
29 an extension contains a JSON configuration file called <code>config.json</code>, 18 an extension contains a JSON configuration file called <code>config.json</code>,
30 in a <code>config_resources</code> folder, the extension can retrieve the file's contents like 19 in a <code>config_resources</code> folder, the extension can retrieve the file's contents like
31 this:</p> 20 this:</p>
32 21
33 <pre> 22 <pre>
34 var xhr = new XMLHttpRequest(); 23 var xhr = new XMLHttpRequest();
(...skipping 119 matching lines...) Expand 10 before | Expand all | Expand 10 after
154 </pre> 143 </pre>
155 <p> 144 <p>
156 Additionally, be especially careful of resources retrieved via HTTP. If your 145 Additionally, be especially careful of resources retrieved via HTTP. If your
157 extension is used on a hostile network, an network attacker (aka a <a 146 extension is used on a hostile network, an network attacker (aka a <a
158 href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">"man-in-the-middle" </a>) 147 href="http://en.wikipedia.org/wiki/Man-in-the-middle_attack">"man-in-the-middle" </a>)
159 could modify the response and, potentially, attack your extension. Instead, 148 could modify the response and, potentially, attack your extension. Instead,
160 prefer HTTPS whenever possible. 149 prefer HTTPS whenever possible.
161 </p> 150 </p>
162 151
163 <!-- END AUTHORED CONTENT --> 152 <!-- END AUTHORED CONTENT -->
OLDNEW
« no previous file with comments | « chrome/common/extensions/docs/static/permissions.html ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698