HTTPS and HTTP CORS

问题:

my questions is simple, but I can not find answer and I have not got ressourcess to test it myself. Can I make HTTPS CORS request from one domain to another HTTPS domain? Can I make HTTP CORS request from one domain to another HTTPS domain? I know, that i can do HTTP CORS request from one domain to another HTTP domain, but I do not know if there is any differences, when I use HTTPS.

Thanks,

Filip.

回答1:

Yes you can.

The only difference is because https is a secure origin, you can only make call to secure origin, so not to http, the browser will block it (see mixed content)

Warning: If you allow http requests to call your https webpage, it will be insecure because it means an attacker can force requests to your https webpage with the cookies of a victim and read the answer

回答2:

Beware if you still need to support IE8/IE9 and are using XDomainRequest as it does not support cross-protocol requests. As per MDN:

The origin's security protocol must match that of the requested URL. (http to http, https to https). If these do not match, the request will error "Access is Denied".