beefproject/beef — Issue #215: Use of XMLHTTPRequest by the beef hook triggers same origin policy in IE and Chrome
Author: passbe
Created: 2011-12-10 22:06:28+00:00
State: open

What steps will reproduce the problem?
1. Run an instance of beef on beef-domain.com
2. Create a hook page on pwned-domain.com and browse there with IE or Chrome
3. Since the domains are different, and the beef hook is attempting to retrieve information from said different domain using XMLHTTPRequest, it triggers same origin policy on IE and Chrome. Also the init script fails in firefox.

Browser Errors:

Chrome:

XMLHttpRequest cannot load http://beef-domain/init. Origin http://pwned-domain is not allowed by Access-Control-Allow-Origin.

IE:

Access Denied Error
Google Code Issue: http://code.google.com/p/beef/issues/detail?id=197