如何修复源码为"https://s3.amazonaws.com“”的阻塞帧访问跨域帧

Question

我已经集成了SCORM xblock和edx-plaform，但我正在尝试启动我的SCORM课程，它在chrome控制台中给我一个错误。

scormfunctions.js:38 Uncaught DOMException: Blocked a frame with origin "https://s3.amazonaws.com" from accessing a cross-origin frame.
    at ScanForAPI (https://s3.amazonaws.com/dev-ironwood-edx-uploads/scorm/aea0be6310754d3aab1649c5282bbd29/c8d75aa6c54a807e870b6afd4dd9a817aacaccc3/shared/scormfunctions.js:38:16)

我在上面分享的一个异常是，当javascript函数试图访问父窗口的window.variable时，浏览器会阻止该访问以防止点击劫持攻击。

我试着在StackOverflow和其他论坛上搜索，但我找不到解决方案。我的想法是，我将不得不使用Content-Security-Policy，如果有人能帮助我指出标题值，我将不胜感激。

Answer 1

我也有同样的问题，所以我使用反向nginx代理来解决CORS问题，正如受人尊敬的@Tom建议的那样。nginx的设置：

proxy_cache_path   /tmp/ levels=1:2 keys_zone=s3_cache:10m max_size=500m
                 inactive=60m use_temp_path=off;

server {
listen  80 default;
server_name scorm.loc; #change if needed
charset     utf-8;
root /var/www/site/public; #change if needed

# max upload size
client_max_body_size 75M;   #change if needed

 location /s3/ {       
    proxy_http_version     1.1;     
    proxy_set_header       Connection "";
    proxy_set_header       Authorization '';
    proxy_set_header       Host s3-eu-west-1.amazonaws.com;  #change if needed
    proxy_hide_header      x-amz-id-2;
    proxy_hide_header      x-amz-request-id;
    proxy_hide_header      x-amz-meta-server-side-encryption;
    proxy_hide_header      x-amz-server-side-encryption;
    proxy_hide_header      Set-Cookie;
    proxy_ignore_headers   Set-Cookie;
    proxy_intercept_errors on;
    add_header             Cache-Control max-age=31536000;
    proxy_pass             http://s3-eu-west-1.amazonaws.com/; #change if needed
}


location /s3_cached/ {
    proxy_cache            s3_cache;
    proxy_http_version     1.1;
    proxy_set_header       Connection "";
    proxy_set_header       Authorization '';
    proxy_set_header       Host s3-eu-west-1.amazonaws.com; #change if needed
    proxy_hide_header      x-amz-id-2;
    proxy_hide_header      x-amz-request-id;
    proxy_hide_header      x-amz-meta-server-side-encryption;
    proxy_hide_header      x-amz-server-side-encryption;
    proxy_hide_header      Set-Cookie;
    proxy_ignore_headers   Set-Cookie;
    proxy_cache_revalidate on;
    proxy_intercept_errors on;
    proxy_cache_use_stale  error timeout updating http_500 http_502 http_503 http_504;
    proxy_cache_lock       on;
    proxy_cache_valid      200 304 60m;
    add_header             Cache-Control max-age=31536000;
    add_header             X-Cache-Status $upstream_cache_status;
    proxy_pass             http://s3-eu-west-1.amazonaws.com/;  #change if needed
}
}

S3存储上存在的SCORM包中的所有静态信息都将在您的域corm.loc/s3/ your _path/your_filename上可用。

Answer 2

如果您同时控制LMS-Server和Content-server，一种常见的方法是使用反向代理。