qt webkit: cross domain xhr's fail when "file:" security scheme is used

[wildabeast]

I know that it isn't supported in many browsers: loading a local file with the "file:" prefix, and making an xmlhttprequest to a "http:" url. However, according to the following (found at http://gitorious.org/qtwebkit/qtwebk...9c9fd98a2526ab), qt webkit should support it:

	/*  Adds the given \a scheme to the list of schemes that are considered equivalent
	    to the \c file: scheme. They are not subject to cross domain restrictions.
	*/
	void QWebSecurityOrigin::addLocalScheme(const QString& scheme)
	{

To reiterate, They are not subject to cross domain restrictions.

Nonetheless, the above situation is failing. For example:

webview->load("file:///C:/Private/..../index.html");

(actually i load a QUrl, ignore my shorthand syntax)
After loading is finished, I check the webview url, and it has the "file:///" prefix, and I check the webFrame->securityOrigin().scheme(), and it equals "file".

Then, in the page, i make an xhr request to, for example, "http://www.nitobi.com". It fails with error INVALID_STATE_ERR: DOM Exception 11

I've tried loading a remote url, which then makes an xmlhttprequest call, and it succeeds, so normal xhr's do work.

[juhanak]

White listing destination URL should fix this problem:

QWebSecurityOrigin::whiteListAccessFromOrigin("file:","http","/www.nitobi.com",true);

[wildabeast]

White listing destination URL should fix this problem:

QWebSecurityOrigin::whiteListAccessFromOrigin("file:","http","/www.nitobi.com",true);

From what I can find, that method is not available in the public Qt API. Private I think.

Also, the domain which is being accessed will not be known at design time ... it will be set in an external html file.

[juhanak]

Hi,
Seems that the function is removed from SecurityOrigin class in 4.6 RC1. It was available in 4.6 beta but without any documentation so maybe it was planned to be removed. My apologies for giving misleading info. Hopefully we find answer for this because it's stopping/making more difficult hybrid web & native application development.

[jakoskin]

Hi,
can you add this to webkit bugzilla https://bugs.webkit.org/ and tag it with Qt ?
If you could add a test case it would be very nice.

Thumbs up for the phonegap effort

[juhanak]

Reported: http://bugs.webkit.org/show_bug.cgi?id=31875

[wildabeast]

Hi,
can you add this to webkit bugzilla https://bugs.webkit.org/ and tag it with Qt ?
If you could add a test case it would be very nice.

Thumbs up for the phonegap effort

Thanks! I noticed that the Qt 4.6 offical release is out. Sick. Any progress with this issue? I was hoping that some API to help me would be exposed in the official release ... but I'm guessing we didn't make it in?

[pmuilu]

Hi,

Try

settings()->setAttribute(QWebSettings::LocalContentCanAccessRemoteUrls,true);

This is now supported in 4.6 and seems to work on Symbian emulator and Windows.

- Petteri

[wildabeast]

Hi,

Try

settings()->setAttribute(QWebSettings::LocalContentCanAccessRemoteUrls,true);

This is now supported in 4.6 and seems to work on Symbian emulator and Windows.

- Petteri

This seems to be working, nice! Thanks. PhoneGap Symbian trucks on.