HTTP status code 0 is maybe Cross-site scripting?

Question

I have a $.ajax that run file in php and pass a variable (email andress). The file works very good but the xhr.status is 0.

This is the code:

    $.ajax({
            type: 'POST',
            url: 'file.php',
            data: { email: destinatario },  
            complete: function(xhr,status){ 
            $('#momentaneo, #force').remove();
            alert(xhr.status);
                if(xhr.status ===  200){
                    alert('ok');                        
                }
                else{
                    alert('no');                        
                }
            }               
        });

This file.php, independently xhr.status, works fine and it add a user to my newsletter. So i don't think that this file is the problem.. It has "0755" permission files and if i run the url of file.php with browser there aren't problems.

The problem is that xhr.status is 0 and i don't understand why... I read that could be "cross-site-scripting" but i don't know if is possibile in my case. I tried also to change tag form in div but nothing.

I add also the file.php:

<?php
 include('wrapper.php');
 $apikey = "76a21109637d7391d1e68e9680e6";
 voxmail_init($apikey);
 voxmail_user_subscribe(array('mail' => $_POST['email'],'privacy' => 1),$_SERVER['REMOTE_ADDR']);

 $header = "Content-type: text/html";
 header($header);
 print('<b>ok</b>');
?>

voxmail are API of newsletter service (i'm sure 101% that api are not problem)

i hope can you help me, thank a lot and sorry for my english

score 1 · Accepted Answer · answered Apr 30 '16 at 14:32

1

I think the problem is that you're checking xhr.status when status is being passed to you as the second parameter in your complete callback. Try this instead:

$.ajax({
  type: 'POST',
  url: 'file.php',
  data: { email: destinatario }
}).always(function(){
  $('#momentaneo, #force').remove();
}).then(function(){
  console.log.apply(console, arguments);
  alert('ok');
}, function(){
  console.warn.apply(console, arguments);
  alert('no');
});

The console statements are only there for debugging purposes and can be removed.

answered Apr 30 '16 at 14:32

idbehold

16,833
5
47
74

in console is there also this "Multiorigine blocked request (cross-origin): the criterion of origin correspondence does not allow reading of remote resource http://www.example.comfile.php. Motivo: header CORS “Access-Control-Allow-Origin” mancante." – Borja Apr 30 '16 at 14:40
@Borja could you show us your server-side code that is handling this request? Are you redirecting the client to another URL in response to this request perhaps? – idbehold Apr 30 '16 at 14:47
@Borja never mind, I see that you already added the server-side code. – idbehold Apr 30 '16 at 14:48
i add this file (with $.ajax) in a page of my website (in the same website there is file.php) and xhr.status is 200. So maybe the problem was really croos-site scripting" when run file (ajax) on local ? :) – Borja Apr 30 '16 at 14:53
@Borja yes, that would likely be your problem. There are a bunch of security measures put in place when you're running off a local file system. If you can setup a local HTTP server (where you would access your local site by going to something like http://mymachine.local or something, just so long as the URL doesn't start with "file://") then you should be okay. – idbehold Apr 30 '16 at 14:56
oh yes it could be a solution ;) thanks a lot with yuor code (console.log) i understand my problem ;) – Borja Apr 30 '16 at 14:59

HTTP status code 0 is maybe Cross-site scripting?

1 Answers1