502421 - capability.policy.default.XMLHttpRequest.open=sameOrigin does not work in 3.5

Status: RESOLVED WONTFIX

(Core :: DOM: Core & HTML, defect)

Description

[Vasya Pupkin]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5

How to disable XMLHttpRequest cross-origin in 3.5?
Setting capability.policy.default.XMLHttpRequest.open to sameOrigin does not work

Reproducible: Always

Steps to Reproduce:
1. put user_pref("capability.policy.default.XMLHttpRequest.open", "sameOrigin"); in prefs.js
2. run cross-origin XMLHttpRequest, such as in attached html

Comment 1

[Vasya Pupkin]

Attachment: XMLHttpRequest example

Comment 2

[Ria Klaassen (not reading all bugmail)]

I get "Error: returned status code 0 Found" as result. This started on 30 Sep 2008: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1949346e6006&tochange=6e39da3e3e20

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=1949346e6006&tochange=6e39da3e3e20 looks like the obvious pick.

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Or https://bugzilla.mozilla.org/show_bug.cgi?id=389508 .  In fact that one is far more likely, lol.

Comment 5

[Vasya Pupkin]

Attachment: updated XMLHttpRequest example, shows if cross-site is ok or not

Comment 6

[Vasya Pupkin]

updated example to show if cross-site is ok or not
so it's been fixed already?

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Indeed, CAPS simply wasn't powerful enough to be able to support the old preference here. Instead set the pref "content.cors.disable"

Comment 8

[:Gavin Sharp [email: [e-mail]]]

Is this WONTFIX, then?

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

IMHO yes