From 15f5e7a55a40ce17cf5117cb079c72e5978276f2 Mon Sep 17 00:00:00 2001 From: "rafaelw@chromium.org" Date: Wed, 2 Sep 2009 01:46:54 +0000 Subject: Extension Doc Changes (no building or testable changes). Added xhr.html. TBR=kathyw,aa Review URL: http://codereview.chromium.org/172097 git-svn-id: svn://svn.chromium.org/chrome/trunk/src@25142 0039d316-1c4b-4281-b951-d872f2087c98 --- chrome/common/extensions/docs/static/xhr.html | 75 +++++ chrome/common/extensions/docs/xhr.html | 426 ++++++++++++++++++++++++++ 2 files changed, 501 insertions(+) create mode 100755 chrome/common/extensions/docs/static/xhr.html create mode 100755 chrome/common/extensions/docs/xhr.html diff --git a/chrome/common/extensions/docs/static/xhr.html b/chrome/common/extensions/docs/static/xhr.html new file mode 100755 index 0000000..8c55058 --- /dev/null +++ b/chrome/common/extensions/docs/static/xhr.html @@ -0,0 +1,75 @@ +
Cross-Origin XMLHttpRequest
+ + +

+In regular web pages, the +XMLHttpRequest +object can be used to send and receive data from remote servers, but is +constrained by the +same origin policy. +Extensions are allowed to access remote servers outside of their origin, +but they must first declare their intent to do so.

+ +

Extension Origin

+

Each running extension exists within it's own seperate security origin. Without +requesting additional priviliges, the extension can use +the XMLHttpRequest to access resources within it's installation. For example, if +the extension contains a JSON configuration file called config.json, +in a config_resources folder, it could retrieve it's contents like +this:

+ +
+var xhr = new XMLHttpRequest();
+xhr.onreadystatechange = handleStateChange; // Implemented elsewhere.
+xhr.open("GET", chrome.extension.getURL('/config_resources/config.json'), true);
+xhr.send();
+
+ +

If the extension attempted to access a security origin other than itself, +say

+ +
+xhr.open("GET", "http://www.google.com", true);
+
+ +

The browser would disallow it.

+ +

Requesting Cross-Origin Permissions

+ +

By adding hosts and/or host match patterns to the +permissions section of the +manifest file, the extension can request access to +remote servers outside of it's origin.

+ +
"permissions": [
+  "http://www.google.com/",
+],
+
+ +

Cross-origin permission values can be either fully qualified host names, +like

+ +
"http://www.google.com/" or
+"http://www.gmail.com/"
+ +

or match patterns, like

+ +
"http://*.google.com/" or
+"http://*/"
+ +

which would allow http access to all reachable domains. Note that here, +match patterns are similar to content script +match patterns, but any path information following the host is ignored.

+ +

Also, note that access is granted both by host and scheme. If an extension +wants secure and non-secure http access to a given host or set +of hosts, it must declare the permissions seperately:

+ +
"permissions": [
+  "http://www.google.com/",
+  "https://www.google.com/",
+],
+
+ + + diff --git a/chrome/common/extensions/docs/xhr.html b/chrome/common/extensions/docs/xhr.html new file mode 100755 index 0000000..110397c --- /dev/null +++ b/chrome/common/extensions/docs/xhr.html @@ -0,0 +1,426 @@ + + + Cross-Origin XMLHttpRequest + + + + +
+ + + + +
+ + + +
+ + + + + +
Cross-Origin XMLHttpRequest
+ + +

+In regular web pages, the +XMLHttpRequest +object can be used to send and receive data from remote servers, but is +constrained by the +same origin policy. +Extensions are allowed to access remote servers outside of their origin, +but they must first declare their intent to do so.

+ +

Extension Origin

+

Each running extension exists within it's own seperate security origin. Without +requesting additional priviliges, the extension can use +the XMLHttpRequest to access resources within it's installation. For example, if +the extension contains a JSON configuration file called config.json, +in a config_resources folder, it could retrieve it's contents like +this:

+ +
var xhr = new XMLHttpRequest();
+xhr.onreadystatechange = handleStateChange; // Implemented elsewhere.
+xhr.open("GET", chrome.extension.getURL('/config_resources/config.json'), true);
+xhr.send();
+
+ +

If the extension attempted to access a security origin other than itself, +say

+ +
xhr.open("GET", "http://www.google.com", true);
+
+ +

The browser would disallow it.

+ +

Requesting Cross-Origin Permissions

+ +

By adding hosts and/or host match patterns to the +permissions section of the +manifest file, the extension can request access to +remote servers outside of it's origin.

+ +
"permissions": [
+  "http://www.google.com/",
+],
+
+ +

Cross-origin permission values can be either fully qualified host names, +like

+ +
"http://www.google.com/" or
+"http://www.gmail.com/"
+ +

or match patterns, like

+ +
"http://*.google.com/" or
+"http://*/"
+ +

which would allow http access to all reachable domains. Note that here, +match patterns are similar to content script +match patterns, but any path information following the host is ignored.

+ +

Also, note that access is granted both by host and scheme. If an extension +wants secure and non-secure http access to a given host or set +of hosts, it must declare the permissions seperately:

+ +
"permissions": [
+  "http://www.google.com/",
+  "https://www.google.com/",
+],
+
+ + + +
+ + + +
+
+ +
+ +#EOF -- cgit v1.1