September.22How to bypass cross-domain java and javascript security restrictions
In a recent project I was developing a java applet that communicates with JavaScript. The applet also loads some dynamic images from a server. Soon I ran into this problem. While running it from the local filesystem it couldn’t load the required images from the server; throws up some security error. Googling a bit, found out that browsers and java-liveconnect does not allow cross domain connectivity. We were not granted access to the server for deployment. So I devised this scheme to fool browser and java runtime.
Here is what is did:
- I edited C:\Windows\System32\etc\drivers\hosts file to add an entry “productionserver.com 127.0.0.1″.
- I installed xampplite in C drive: C:\xampplite .
- Copied all my html, javascript and jar files to a folder “demo” under C:\xampplite\htdocs\
- Created an htaccess file in C:\xampplite\htdocs\.htaccess with the following codes in the file:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ %{REQUEST_URI} [P]
- Enabled the mod_proxy module in C:\xampplite\apache\conf\httpd.conf by uncommenting the following lines:
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_http_module modules/mod_proxy_http.so
- Started the apache server from xampp-control.
- Changed my browsers proxy settings to IP:127.0.0.1 Port:80 and browsed to productionserver.com/demo6/AppletDemoPage.html .
Voila!! the browser and java virtual machine are tricked to thinking that all local html,applet,js and remote images are from the same domain.
Here, the htaccess file does the trick. If it finds any file in the local filesystem, it serves that file from there. Else it tries to retrive the file through the proxy module.
Hope it helps someone some troubles.

Leave a Reply