Timeline for Is it possible to get the response from a form POST?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 9, 2021 at 19:30 | comment | added | 0Valt |
@JMP eh, yeah, that would be neat - however all the submit() does (as I think you know) is launch the same form submission algorithm always ending in navigation. I suppose you can try making a feature request post for allowing the response pages to be embedded on origins other than api.stackexchange.com (from our conversation I assume your app is not a userscript and is hosted somewhere on a domain you own) but... just don't expect anything to be done any time soon. As I am sure you noticed, the API isn't the highest priority for the company, which is a shame
|
|
| Nov 9, 2021 at 3:37 | vote | accept | JMP | ||
| Nov 9, 2021 at 3:37 | comment | added | JMP |
The FORM equivalent to AJAX would be something like response=form.submit();, and so the code would be a lot neater. I think it is just API calls that issue responses that need the directive altering - for example, the documentation is in the API subdomain, and this could be hijacked without it.
|
|
| Nov 9, 2021 at 0:34 | comment | added | 0Valt |
you mean you want to place the form in an <iframe>, listen for the load event, and read the response text from the parent frame? Seems like a possibility (but you are mentioning the CSP directive frame-ancestors which is set to self for the SE API, which is a problem), just not sure why would you want to do that when you have access to all the power of AJAX?
|
|
| Nov 7, 2021 at 2:51 | comment | added | JMP | and therefore could be removed for API calls. Does this make any sense? (I could then load them into an iframe and read the document from there. | |
| Nov 7, 2021 at 2:50 | comment | added | JMP | From this post: stackoverflow.com/questions/37799258/…, I found: w3c.github.io/webappsec-csp/#directive-frame-ancestors ,with the line: "Resources can use this directive to avoid many UI Redressing [UISECURITY] attacks, by avoiding the risk of being embedded into potentially hostile contexts.". I wouldn't have thought a text response to an API call falls into this category, and it makes me think that the SE directive for this is placed arbitrarily high on your server, so that these pages are accidentally affected. | |
| Nov 6, 2021 at 18:46 | history | answered | 0Valt | CC BY-SA 4.0 |