javascript - Google ReCaptcha 未捕获的 DOMException : Blocked a frame with origin "https://www.google.com"

Question

我不确定为什么会这样，这不是以下常见的常见错误:

Uncaught SecurityError: Block a frame with origin.

我得到的错误是:

Uncaught DOMException: Blocked a frame with origin "https://www.google.com" from accessing a cross-origin frame.

我正在按照 Google 关于如何启用 ReCaptcha 的说明进行操作，但它对我不起作用!

// top of the page
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
// then somewhere in the bottom
<div class="g-recaptcha" data-sitekey="@Model.Register.CaptchaSiteKey"></div>

正在加载我的 CaptchaSiteKey(我调试并检查过)。

Answer 1

The same-origin policy is an important concept in the web application security model. Under the policy, a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin. An origin is defined as a combination of URI scheme, hostname, and port number. This policy prevents a malicious script on one page from obtaining access to sensitive data on another web page through that page's Document Object Model.

换句话说:recaptcha是一个Remote Script资源，出于安全考虑，您的web服务器不允许使用外部资源代码。

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

要允许任何资源访问您的资源，您可以指定:

Access-Control-Allow-Origin: *

允许https://www.google.com要访问您的资源，您可以指定:

Access-Control-Allow-Origin: https://www.google.com