PHP如何利用P3P实现跨域
发布时间:2023-11-23 20:16:58
有别于JS跨域、IFRAME跨域等的常用处理办法,还可以利用P3P来实现跨域。
P3P是什么
P3P(Platform for Privacy Preferences)是W3C公布的一项隐私保护推荐标准,以为用户提供隐私保护。
P3P标准的构想是:Web 站点的隐私策略应该告之访问者该站点所收集的信息类型、信息将提供给哪些人、信息将被保留多少时间及其使用信息的方式,如站点应做诸如 “本网站将监测您所访问的页面以提高站点的使用率”或“本网站将尽可能为您提供更合适的广告”等申明。访问支持P3P网站的用户有权查看站点隐私报告,然 后决定是否接受cookie 或是否使用该网站。
如何利用P3P实现跨域
在开发中,我们碰到的跨域主要还是纠结在IE,页面中的IFRAME或者FRAME或者JS跨域的时候,IE有安全策略限制页面不带cookie,但是如果我们加上P3P,就没有这策略的限制。这也是P3P来突破跨域的可行前提。
以下为摘录的例子:
http://www.a.com/a_setcookie.php 文件内容:
<?php setcookie("test", $_GET['id'], time()+3600, "/", ".a.com"); ?>
http://www.a.com/a_getcookie.php 文件内容:
<?php var_dump($_COOKIE); ?>
http://www.b.com/b_setcookie.php 文件内容:
<script src="http://www.a.com/a_setcookie.php?id=www.b.com"></script>
通过浏览器访问:
1?> http://www.b.com/b_setcookie.php
2?> http://www.a.com/a_getcookie.php
访问1 b.com域后,我们并没有在2 a.com域发现设置上cookie值。
将http://www.a.com/a_setcookie.php文件内容改为如下:
<?php
header('P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"');
setcookie("test", $_GET['id'], time()+3600, "/", ".a.com");
?>
再次访问:
http://www.b.com/b_setcookie.php
http://www.a.com/a_getcookie.php
在访问b.com域后,设置了a.com域的cookie值。
从上面例子可以看出通过发送P3P头信息而实现的跨域。(在Firefox不发送P3P也能跨域成功)
PHP使用P3P协议
header( 'P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"' );
JS使用P3P协议
xmlhttp.setRequestHeader( "P3P" , 'CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"' );
P3P的头部参数解释
引用:
P3P Header is present:
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Compact Policy token is present. A trailing 'o' means opt-out, a trailing 'i' means opt-in.
CURa
Information is used to complete the activity for which it was provided.
ADMa
Information may be used for the technical support of the Web site and its computer system.
DEVa
Information may be used to enhance, evaluate, or otherwise review the site, service, product, or market.
PSAo
Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting, but it will not be used to attempt to identify specific individuals.
PSDo
Information may be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data (such as name, address, phone number, or email address) to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual, but it will not be used to attempt to identify specific individuals.
OUR
We share information with ourselves and/or entities acting as our agents or entities for whom we are acting as an agent.
BUS
Info is retained under a service provider's stated business practices. Sites MUST have a retention policy that establishes a destruction time table. The retention policy MUST be included in or linked from the site's human-readable privacy policy.
UNI
Non-financial identifiers, excluding government-issued identifiers, issued for purposes of consistently identifying or recognizing the individual. These include identifiers issued by a Web site or service.
PUR
Information actively generated by the purchase of a product or service, including information about the method of payment.
INT
Data actively generated from or reflecting explicit interactions with a service provider through its site -- such as queries to a search engine, or logs of account activity.
DEM
Data about an individual's characteristics -- such as gender, age, and income.
STA
Mechanisms for maintaining a stateful session with a user or automatically recognizing users who have visited a particular site or accessed particular content previously -- such as HTTP cookies.
PRE
Data about an individual's likes and dislikes -- such as favorite color or musical tastes.
COM
Information about the computer system that the individual is using to access the network -- such as the IP number, domain name, browser type or operating system.
NAV
Data passively generated by browsing the Web site -- such as which pages are visited, and how long users stay on each page.
OTC
Other types of data not captured by the above definitions.
NOI
Web Site does not collected identified data.
DSP
The privacy policy contains DISPUTES elements.
COR
Errors or wrongful actions arising in connection with the privacy policy will be remedied by the service.
PS,这里说的跨域主要是设置cookie的情况,如果是跨域读取cookie,要保证在对应设置cookie的时候设置了P3P,否则在读取的事情IE会屏蔽跨域cookie。
猜你喜欢
- 1 create table test(coltest varchar(20))2 实现这一功能 的 sql 语句 s
- 问题描述:使用 SQL 2005 w/ SP2 的汇出汇入精灵将数据从 Access 汇入到 SQL2005 发生了错误,但使用在SQL 2
- 简介Simon Willison来自英国,是一名经验丰富的开发人员。曾工作于Yahoo,是Web开发框架Django的创始人之一,也是Ope
- 代码如下:'******************************************** '函数名:I
- 下列语句部分是Mssql语句,不可以在access中使用。SQL语句分类:DDL—数据定义语言(CREATE,ALTER,DROP,DECL
- 从PJBlog 2.7开始,验证码的功能就很好很强大了,但是同时也给手工输入带来了不小的麻烦——经常输错。之前我写了一个《自己写的一个PJB
- PDO::getAttributePDO::getAttribute — 取回一个数据库连接的属性(PHP 5 >= 5.1.0, P
- 在网页中,我们经常需要引用大量的javascript和css文件,在加上许多javascript库都包含debug版和经过压缩的releas
- 原文地址:30 Days of Mootools 1.2 Tutorials - Day 12 - Drag and Drop using
- 说起来惭愧,总是犯一些小错误,纠结半天,这不应为一个分号的玩意折腾了好半天! 错误时在执行SQL语句的时候发出的,信息如下: Java代码
- 调用bianli()函数,这里是遍历F:盘,bianli("F:\")'这里设置文件夹路径,你可以改为其它文件夹
- javascript上下滑动广告效果 参数说明:客服果果(
- 最近发现一个问题,是关于IDEA的一些骚操作的事儿~具体怎么回事,一起来看看。我们都知道使用git分布式版本控制工具,提、拉 代码都会有一个
- 下面代码即是VBScript代码在服务器端编译后的显示内容,如果我们把这段代码保存成静态文件(HTML)或JS文件,那么上一篇提出的问题就迎
- 揭秘一个普通的输入框背后惊人的秘密。某月某日,某项目某页面,需要一个价格区间筛选功能,需求合理,所以设计做上去。这是一个无比普通的输入框。在
- 很对编程语言都支持递归函数,Go语言也不例外,所谓递归函数指的是在函数内部调用函数自身的函数,从数学解题思路来说,递归就是把一个大问题拆分成
- 什么是设计模式设计模式是针对软件开发中出现的常见问题的可重用解决方案。它们并不特定于任何编程语言或框架,而是描述了可应用于各种情况的一般原则
- 当“ 页面重构工程师 ”这个职位的面试官也蛮长一段时间了,跟前两年比起来,总的来说来应聘的同学能力在很大程度上有了提高,记得两年前的一场招聘
- JSP 开发之 releaseSession的实例详解Hibernate可以实现分页查询,昨天试了一下,分页效果不错。但是发现了一个问题,就
- 地图服务是指可以提供数据信息的接口,比如说本地搜索/路线规划等,下面小编给大家整理下百度地图API之本地搜索和范围搜索,具体请看下文。地图服