Let's assume we've a architecture like this:

[HTTPS JSON API] <-- INTERNET --> [Single-Page-Webapplication using XHR] <---> [Locally installed HTTP Server]

The users browser would refuse the connection to the local HTTP because of Mixed Content policy. So how would we implement the communication in this case?

  • Strict Transport Security is for a domain. Dec 10, 2014 at 12:31
  • Fixed this, the problem here is mixed content policy.
    – Paddi91
    Dec 10, 2014 at 13:02

1 Answer 1


Due to the same-origin policy, JavaScript running on a remote site cannot use an XHR to access content running on another domain. Cross-Origin Resource Sharing (CORS) is one solution to this problem.

The server running on localhost, can define a CORS header which permits JavaScript running on a specific domain access to the server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .