需要进行防盗链的绕过，我们必须先要了解Iframe、Referer和XMLHttpRequest对象的基本知识
目录
Iframe
基本用法
sandbox 属性
loading 属性
Referer
Referrer-policy
设置referrer的两种方法
下面举三个将referrer设置为no-referrer的例子：
首先是没有设置no-referrer的，即有referer
这里是referer1中使用方法1设置了no-referer
这里是referer1中使用方法2设置了no-referer
XMLHttpRequest
简介
盗链
防盗链的工作原理
为什么我们要绕过防盗链？
绕过防盗链的几种方式
利用HTTPS网站盗链http资源网站(HTTPS->HTTP)
利用在头部设置meta
利用referrerpolicy="no-referrer"
利用iframe伪造请求referer
利用XMLHttpRequest
利用fetch
</code>标签用于在网页里面嵌入其他网页。</p> <h3 id="%E5%9F%BA%E6%9C%AC%E7%94%A8%E6%B3%95" style="background-color:transparent;"><a name="t1"></a>基本用法</h3> <p><strong><code><iframe></code>标签生成一个指定区域，在该区域中嵌入其他网页。</strong>它是一个容器元素，如果浏览器不支持<code><iframe></code>，就会显示内部的子元素。</p> <pre data-index="0" class="set-code-show" name="code"><code class="language-html hljs language-xml"><ol class="hljs-ln" style="width:100%"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">iframe</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"https://www.example.com"</span></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-attr">width</span>=<span class="hljs-string">"100%"</span> <span class="hljs-attr">height</span>=<span class="hljs-string">"500"</span> <span class="hljs-attr">frameborder</span>=<span class="hljs-string">"0"</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-attr">allowfullscreen</span> <span class="hljs-attr">sandbox</span>> //这里的sandbox可以保证安全</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">p</span>></span><span class="hljs-tag"><<span class="hljs-name">a</span> <span class="hljs-attr">href</span>=<span class="hljs-string">"https://www.example.com"</span>></span>点击打开嵌入页面<span class="hljs-tag"></<span class="hljs-name">a</span>></span><span class="hljs-tag"></<span class="hljs-name">p</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">iframe</span>></span></div></div></li></ol></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>上面的代码在当前网页嵌入<code>https://www.example.com</code>，显示区域的宽度是<code>100%</code>，高度是<code>500</code>像素。如果当前浏览器不支持<code><iframe></code>，则会显示一个链接，让用户点击。</p> <p>浏览器普遍支持<code><iframe></code>，所以内部的子元素可以不写。</p> <p><code>iframe</code>的属性如下：</p> <ul><li> <p><code>allowfullscreen</code>：允许嵌入的网页全屏显示，需要全屏 API 的支持，请参考相关的 JavaScript 教程。</p> </li><li> <p><code>frameborder</code>：是否绘制边框，<code>0</code>为不绘制，<code>1</code>为绘制（默认值）。建议尽量少用这个属性，而是在 CSS 里面设置样式。</p> </li><li> <p><code>src</code>：嵌入的网页的 URL。</p> </li><li> <p><code>width</code>：显示区域的宽度。</p> </li><li> <p><code>height</code>：显示区域的高度。</p> </li><li> <p><code>sandbox</code>：设置嵌入的网页的权限，详见下文。</p> </li><li> <p><code>importance</code>：浏览器下载嵌入的网页的优先级，可以设置三个值。<code>high</code>表示高优先级，<code>low</code>表示低优先级，<code>auto</code>表示由浏览器自行决定。</p> </li><li> <p><code>name</code>：内嵌窗口的名称，可以用于<code><a></code>、<code><form></code>、<code><base></code>的<code>target</code>属性。</p> </li><li> <p><code>referrerpolicy</code>：请求嵌入网页时，HTTP 请求的<code>Referer</code>字段的设置。参见<code><a></code>标签的介绍。</p> </li></ul> <h3 id="sandbox%20%E5%B1%9E%E6%80%A7" style="background-color:transparent;"><a name="t2"></a><a href="https://so.csdn.net/so/search?q=sandbox&spm=1001.2101.3001.7020" target="_blank" class="hl hl-1" data-report-view="{"spm":"1001.2101.3001.7020","dest":"https://so.csdn.net/so/search?q=sandbox&spm=1001.2101.3001.7020","extra":"{\"searchword\":\"sandbox\"}"}" data-report-click="{"spm":"1001.2101.3001.7020","dest":"https://so.csdn.net/so/search?q=sandbox&spm=1001.2101.3001.7020","extra":"{\"searchword\":\"sandbox\"}"}" data-tit="sandbox" data-pretit="sandbox">sandbox</a> 属性</h3> <p>嵌入的网页默认具有正常权限，比如执行脚本、提交表单、弹出窗口等。如果嵌入的网页是其他网站的页面，你不了解对方会执行什么操作，因此就存在安全风险。</p> <p><strong>为了限制<code><iframe></code>的风险，HTML 提供了<code>sandbox</code>属性，允许设置嵌入的网页的权限，等同于提供了一个隔离层，即“沙箱”。</strong></p> <p><code>sandbox</code>可以当作布尔属性使用，表示打开所有限制。</p> <pre data-index="1" class="set-code-show" name="code"><code class="language-html hljs language-xml"><ol class="hljs-ln" style="width:100%"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">iframe</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"https://www.example.com"</span> <span class="hljs-attr">sandbox</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">iframe</span>></span></div></div></li></ol></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p><code>sandbox</code>属性可以设置具体的值，表示逐项打开限制。未设置某一项，就表示不具有该权限。</p> <blockquote> <p>以最小权限为原则</p> </blockquote> <p><strong><span style="color:#fe2c24;">注意，不要同时设置<code>allow-scripts</code>和<code>allow-same-origin</code>属性，这将使得嵌入的网页可以改变或删除<code>sandbox</code>属性。</span></strong></p> <h3 id="loading%20%E5%B1%9E%E6%80%A7" style="background-color:transparent;"><a name="t3"></a>loading 属性</h3> <p><code><iframe></code>指定的网页会立即加载，有时这不是希望的行为。</p> <p><code><iframe></code>滚动进入视口以后再加载，这样会比较节省带宽。</p> <p><code>loading</code>属性可以触发<code><iframe></code>网页的懒加载。</p> <p>该属性可以取以下三个值：</p> <ul><li> <p><code>auto</code>：浏览器的默认行为，与不使用<code>loading</code>属性效果相同。</p> </li><li> <p><code>lazy</code>：<code><iframe></code>的懒加载，即将滚动进入视口时开始加载。</p> </li><li> <p><code>eager</code>：立即加载资源，无论在页面上的位置如何。</p> </li></ul> <pre data-index="2" class="set-code-show" name="code"><code class="language-html hljs language-xml"><span class="hljs-tag"><<span class="hljs-name">iframe</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"https://example.com"</span> <span class="hljs-attr">loading</span>=<span class="hljs-string">"lazy"</span>></span><span class="hljs-tag"></<span class="hljs-name">iframe</span>></span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>上面代码会启用<code><iframe></code>的懒加载。</p> <p>有一点需要注意，如果<code><iframe></code>是隐藏的，则<code>loading</code>属性无效，将会立即加载。</p> <h2 id="Referer"><a name="t4"></a><a href="https://so.csdn.net/so/search?q=Referer&spm=1001.2101.3001.7020" target="_blank" class="hl hl-1" data-report-view="{"spm":"1001.2101.3001.7020","dest":"https://so.csdn.net/so/search?q=Referer&spm=1001.2101.3001.7020","extra":"{\"searchword\":\"Referer\"}"}" data-report-click="{"spm":"1001.2101.3001.7020","dest":"https://so.csdn.net/so/search?q=Referer&spm=1001.2101.3001.7020","extra":"{\"searchword\":\"Referer\"}"}" data-tit="Referer" data-pretit="referer">Referer</a></h2> <p>一定程度上防御crsf（客户端请求伪造）</p> <p><strong>Referer</strong>请求包含了当前请求页面的来源页面的地址，即表示当前页面是通过此来源页面的链接进入的。</p> <h3 id="Referrer-policy"><a name="t5"></a><strong>Referrer-policy</strong></h3> <p>Referer-policy作用就是为了控制请求头部中的referer的内容包含了以下信息：</p> <ul><li> <p>no-referer：整个referer首部会被移除，访问来源信息不随着请求一起发送。</p> </li><li> <p>no-referer-when-downgrade:在没有指定任何策略的情况下用户代理的默认行为。在同安全等级的情况下，发送文件的源为引用地址（HTTPS->HTTPS）；在降级的情况下不会发送此首部(HTTPS->HTTP)</p> </li><li> <p>origin：在任何情况下，仅发送文件的源作为引用地址</p> </li><li> <p>orgin-when-cross-origin：对于同源的请求，会发送完整的URL作为引用地址，但是对于非同源请求仅仅发送文件的源</p> </li><li> <p>same-orgin：对于同源的请求会发送引用地址，但是对于非的同源请求则不发送引用地址信息。</p> </li><li> <p>strict-origin：在同等安全级别的情况下，发送文件的源作为引用地址（HTPPS->HTTPS），但是在降级的情况下不会发送（HTTPS->HTTP)</p> </li><li> <p>strict-origin-cross-origin，对于同源的请求，会发送完整的URL作为引用地址；在同安全等级的情况下，发送文件的源为引用地址（HTTPS->HTTPS）；在降级的情况下不会发送此首部(HTTPS->HTTP)</p> </li><li> <p>unsafe-url：无论是同源请求还是非同源请求，都发送完整的URL（移除参数信息后）作为引用地址。（最不安全了）</p> </li></ul> <h3 id="%E8%AE%BE%E7%BD%AEreferrer%E7%9A%84%E4%B8%A4%E7%A7%8D%E6%96%B9%E6%B3%95"><a name="t6"></a>设置referrer的两种方法</h3> <p>方法1：在html页面中的head标签中的meta中设置</p> <pre data-index="3" class="set-code-show" name="code"><code class="language-html hljs language-xml"><span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"referer"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"no-referer"</span>></span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>方法2：在引入script的script标签的属性中设置referrerpolicy="no-referer"</p> <h3 id="%E4%B8%8B%E9%9D%A2%E4%B8%BE%E4%B8%89%E4%B8%AA%E5%B0%86referrer%E8%AE%BE%E7%BD%AE%E4%B8%BAno-referrer%E7%9A%84%E4%BE%8B%E5%AD%90%EF%BC%9A" style="background-color:transparent;"><a name="t7"></a>下面举三个将referrer设置为no-referrer的例子：</h3> <h4 id="%E9%A6%96%E5%85%88%E6%98%AF%E6%B2%A1%E6%9C%89%E8%AE%BE%E7%BD%AEno-referrer%E7%9A%84%EF%BC%8C%E5%8D%B3%E6%9C%89referer"><a name="t8"></a>首先是没有设置no-referrer的，即有referer</h4> <p>（1）首先编写referer1.html</p> <pre data-index="4" class="set-code-hide" name="code"><code class="language-html hljs language-xml"><ol class="hljs-ln" style="width:100%"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-meta"><!DOCTYPE <span class="hljs-keyword">html</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">html</span> <span class="hljs-attr">lang</span>=<span class="hljs-string">"en"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">head</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="6"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">charset</span>=<span class="hljs-string">"UTF-8"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="7"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">http-equiv</span>=<span class="hljs-string">"X-UA-Compatible"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"IE=edge"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="8"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"viewport"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"width=device-width, initial-scale=1.0"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="9"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">title</span>></span>Document<span class="hljs-tag"></<span class="hljs-name">title</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="10"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">head</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="11"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="12"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">body</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="13"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment"><!-- noreferer测试 --></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="14"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">div</span>></span>aaa<span class="hljs-tag"></<span class="hljs-name">div</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="15"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">body</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="16"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="17"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">html</span>></span></div></div></li></ol></code><div class="hide-preCode-box"><span class="hide-preCode-bt" data-report-view="{"spm":"1001.2101.3001.7365"}"><img class="look-more-preCode contentImg-no-view" src="https://1000bd.com/contentImg/2022/06/27/191644837.png" alt="" title=""></span></div><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>这里并没有什么特别的，就是在页面中有一个div标签，其中写着aaa </p> <p>（2）编写referer2.html</p> <pre data-index="5" class="set-code-hide" name="code"><code class="language-html hljs language-xml"><ol class="hljs-ln" style="width:100%"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-meta"><!DOCTYPE <span class="hljs-keyword">html</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">html</span> <span class="hljs-attr">lang</span>=<span class="hljs-string">"en"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">head</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">charset</span>=<span class="hljs-string">"UTF-8"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="6"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">http-equiv</span>=<span class="hljs-string">"X-UA-Compatible"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"IE=edge"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="7"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"viewport"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"width=device-width, initial-scale=1.0"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="8"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">title</span>></span>Document<span class="hljs-tag"></<span class="hljs-name">title</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="9"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">head</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="10"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">h1</span>></span>hello world<span class="hljs-tag"></<span class="hljs-name">h1</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="11"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">a</span> <span class="hljs-attr">href</span>=<span class="hljs-string">"./referer1.html"</span>></span>123<span class="hljs-tag"></<span class="hljs-name">a</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="12"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">这里使用链接的形式访问test.html网页</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="13"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">body</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="14"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">body</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="15"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="16"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">html</span>></span></div></div></li></ol></code><div class="hide-preCode-box"><span class="hide-preCode-bt" data-report-view="{"spm":"1001.2101.3001.7365"}"><img class="look-more-preCode contentImg-no-view" src="https://1000bd.com/contentImg/2022/06/27/191644837.png" alt="" title=""></span></div><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>这里使用a标签尝试将referer1.html插入到a标签中 </p> <p>（3）测试</p> <p>在浏览器的URL中访问referer2.html</p> <h2 id="%E2%80%8B%E7%BC%96%E8%BE%91"><a name="t9"></a><img alt="" height="158" src="https://1000bd.com/contentImg/2023/11/19/195530878.png" ></h2> <h2><a name="t10"></a><img alt="" height="235" src="https://1000bd.com/contentImg/2023/11/19/195530891.png" ></h2> <h2><a name="t11"></a><img alt="" height="289" src="https://1000bd.com/contentImg/2023/11/19/195531631.png" ></h2> <h4 id="%E8%BF%99%E9%87%8C%E6%98%AFreferer1%E4%B8%AD%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%951%E8%AE%BE%E7%BD%AE%E4%BA%86no-referer"><a name="t12"></a>这里是referer1中使用方法1设置了no-referer</h4> <p>在referer中增加这样一行：</p> <pre data-index="6" class="set-code-show" name="code"><code class="language-html hljs language-xml"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"referrer"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"no-referrer"</span>></span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>然后使用上面相同的方式查看是否有referer</p> <h2 id="%C2%A0%E2%80%8B%E7%BC%96%E8%BE%91"><a name="t13"></a> <img alt="" height="267" src="https://1000bd.com/contentImg/2023/11/19/195531575.png" ></h2> <p>可以看到，这里已经没有referer了</p> <h4 id="%E8%BF%99%E9%87%8C%E6%98%AFreferer1%E4%B8%AD%E4%BD%BF%E7%94%A8%E6%96%B9%E6%B3%952%E8%AE%BE%E7%BD%AE%E4%BA%86no-referer"><a name="t14"></a>这里是referer1中使用方法2设置了no-referer</h4> <p>（1）修改referer1页面为：</p> <pre data-index="7" class="set-code-hide" name="code"><code class="language-html hljs language-xml"><ol class="hljs-ln" style="width:100%"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-meta"><!DOCTYPE <span class="hljs-keyword">html</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">html</span> <span class="hljs-attr">lang</span>=<span class="hljs-string">"en"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">head</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">charset</span>=<span class="hljs-string">"UTF-8"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="6"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">http-equiv</span>=<span class="hljs-string">"X-UA-Compatible"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"IE=edge"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="7"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"viewport"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"width=device-width, initial-scale=1.0"</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="8"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">title</span>></span>Document<span class="hljs-tag"></<span class="hljs-name">title</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="9"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">head</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="10"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="11"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"><<span class="hljs-name">body</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="12"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">script</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"./test.js"</span> <span class="hljs-attr">Referrerpolicy</span>=<span class="hljs-string">"no-referrer"</span>></span><span class="language-javascript"></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="13"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment">//这里使用no-referrer禁用referrer</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="14"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"></<span class="hljs-name">script</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="15"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment"><!-- noreferer测试 --></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="16"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-tag"><<span class="hljs-name">div</span>></span>aaa<span class="hljs-tag"></<span class="hljs-name">div</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="17"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">body</span>></span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="18"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="19"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-tag"></<span class="hljs-name">html</span>></span></div></div></li></ol></code><div class="hide-preCode-box"><span class="hide-preCode-bt" data-report-view="{"spm":"1001.2101.3001.7365"}"><img class="look-more-preCode contentImg-no-view" src="https://1000bd.com/contentImg/2022/06/27/191644837.png" alt="" title=""></span></div><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>（2）然后我们新建一个名为test.js的文件</p> <p>内容为：</p> <pre data-index="8" class="set-code-show" name="code"><code class="language-html hljs language-xml">alert(document.cookie);</code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>（3）然后访问referer1.html</p> <h2><a name="t15"></a><img alt="" height="280" src="https://1000bd.com/contentImg/2023/11/19/195530993.png" ></h2> <p>可以看到，没有referer，由于没有了referer我们也可以看到成功的弹窗了</p> <h2 id="XMLHttpRequest" style="background-color:transparent;"><a name="t16"></a>XMLHttpRequest</h2> <h3 id="%E7%AE%80%E4%BB%8B"><a name="t17"></a>简介</h3> <p>浏览器与服务器之间，采用 HTTP 协议通信。用户在浏览器地址栏键入一个网址，或者通过网页表单向服务器提交内容，这时浏览器就会向服务器发出 HTTP 请求。</p> <p><code>XMLHttpRequest</code>对象是 AJAX 的主要接口，<strong>用于浏览器与服务器之间的通信。</strong>尽管名字里面有<code>XML</code>和<code>Http</code>，它实际上可以使用多种协议（比如<code>file</code>或<code>ftp</code>），发送任何格式的数据（包括字符串和二进制）。</p> <p><strong><code>XMLHttpRequest</code>本身是一个构造函数，可以使用<code>new</code>命令生成实例。它没有任何参数。</strong></p> <pre data-index="9" class="set-code-show" name="code"><code class="language-javascript hljs"><span class="hljs-keyword">var</span> xhr = <span class="hljs-keyword">new</span> <span class="hljs-title class_">XMLHttpRequest</span>();<span class="hljs-comment">//即初始化时没有任何参数</span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>一旦新建实例，就可以使用<code>open()</code>方法指定建立 HTTP 连接的一些细节。</p> <pre data-index="10" class="set-code-show" name="code"><code class="language-javascript hljs">xhr.<span class="hljs-title function_">open</span>(<span class="hljs-string">'GET'</span>, <span class="hljs-string">'http://www.example.com/page.php'</span>, <span class="hljs-literal">true</span>);<span class="hljs-comment">//open方法</span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>上面代码指定使用 GET 方法，跟指定的服务器网址建立连接。</p> <p>第三个参数<code>true</code>，表示请求是异步的。</p> <p>然后，指定回调函数，监听通信状态（<code>readyState</code>属性）的变化。</p> <pre data-index="11" class="set-code-show" name="code"><code class="language-javascript hljs"><ol class="hljs-ln" style="width:100%"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">xhr.<span class="hljs-property">onreadystatechange</span> = handleStateChange; </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">function</span> <span class="hljs-title function_">handleStateChange</span>(<span class="hljs-params"></span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment">// ...</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">}</div></div></li></ol></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>上面代码中，一旦<code>XMLHttpRequest</code>实例的状态发生变化，就会调用监听函数<code>handleStateChange</code></p> <p>最后使用<code>send()</code>方法，实际发出请求。</p> <pre data-index="12" class="set-code-show" name="code"><code class="language-javascript hljs">xhr.<span class="hljs-title function_">send</span>(<span class="hljs-literal">null</span>);</code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>上面代码中，<strong><code>send()</code>的参数为<code>null</code>，表示发送请求的时候，不带有数据体</strong>。</p> <p><strong>如果发送的是 POST 请求，这里就需要指定数据体。</strong></p> <p>一旦拿到服务器返回的数据，AJAX 不会刷新整个网页，而是只更新网页里面的相关部分，从而不打断用户正在做的事情。</p> <p>注意：<strong>AJAX 只能向同源网址（协议、域名、端口都相同）发出 HTTP 请求</strong>，<strong>如果发出跨域请求，就会报错</strong></p> <h2 id="%E7%9B%97%E9%93%BE" style="background-color:transparent;"><a name="t18"></a>盗链</h2> <p>盗链是指自己的页面上展示以下并不在自己服务器上的一些内容，获别人的资源地址，绕过别人的资源展示页面，直接在自己的页面上向最终用户提供此内容，一般被盗链的都是图片、可执行文件、音频文件、压缩文件等资源。</p> <p>通过盗链的手段可以减轻自己服务器的负担。</p> <h3 id="%E9%98%B2%E7%9B%97%E9%93%BE%E7%9A%84%E5%B7%A5%E4%BD%9C%E5%8E%9F%E7%90%86" style="background-color:transparent;"><a name="t19"></a>防盗链的工作原理</h3> <p>通过referere或者签名，网站可以检测目标网页访问的来源网页，如果是资源文件，则可以追踪到显示它网页地址，一旦检测到来源不是本站点，即进行阻止或者返回指定的页面</p> <h3 id="%E4%B8%BA%E4%BB%80%E4%B9%88%E6%88%91%E4%BB%AC%E8%A6%81%E7%BB%95%E8%BF%87%E9%98%B2%E7%9B%97%E9%93%BE%EF%BC%9F"><a name="t20"></a>为什么我们要绕过防盗链？</h3> <p>因为通过referere或者签名，网站可以检测目标网页访问的来源网页，如果是资源文件，则可以追踪到显示它网页地址，一旦检测到来源不是本站点，即进行阻止或者返回指定的页面</p> <p>三种情况下允许引用图片：</p> <ol><li> <p>本网站</p> </li><li> <p><u><strong>无referer信息的情况下。</strong></u>（服务器认为从浏览器直接访问图片的图片的URL，所以这种情况下能正常访问）</p> </li><li> <p>授权的网址</p> </li></ol> <p>我们可以在https的网页中用http请求另一个https网站的资源。</p> <p>此时可以不发送我们的referer字段，达到绕过防盗链的效果（由于浏览器的升级，现在这种操作已经被禁止了）</p> <p>实现原理：在访问图片时让其无referrer</p> <h2 id="%E7%BB%95%E8%BF%87%E9%98%B2%E7%9B%97%E9%93%BE%E7%9A%84%E5%87%A0%E7%A7%8D%E6%96%B9%E5%BC%8F"><a name="t21"></a>绕过防盗链的几种方式</h2> <h3 id="%E5%88%A9%E7%94%A8HTTPS%E7%BD%91%E7%AB%99%E7%9B%97%E9%93%BEhttp%E8%B5%84%E6%BA%90%E7%BD%91%E7%AB%99(HTTPS-%3EHTTP)" style="background-color:transparent;"><a name="t22"></a><strong>利用HTTPS网站盗链http资源网站(HTTPS->HTTP)</strong></h3> <p><strong>现在这种方式已经无法复现了</strong></p> <h3 id="%E5%88%A9%E7%94%A8%E5%9C%A8%E5%A4%B4%E9%83%A8%E8%AE%BE%E7%BD%AEmeta" style="background-color:transparent;"><a name="t23"></a>利用在头部设置meta</h3> <p>（1）首先在refrrer1文件中添加一行</p> <pre data-index="13" class="set-code-show" name="code"><code class="language-html hljs language-xml"> <span class="hljs-tag"><<span class="hljs-name">img</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"https://img-blog.csdnimg.cn/5ff039c8a8cd47c98e26d694854e8962.jpeg"</span> <span class="hljs-attr">alt</span>=<span class="hljs-string">"你这图有问题啊"</span>></span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>（2）尝试访问</p> <h2><a name="t24"></a><img alt="" height="93" src="https://1000bd.com/contentImg/2023/11/19/195531985.png" ></h2> <p>很明显图片没有加载出来，因为csdn网站将发现我们的referer并不是一个合法的网站，不会让我们加载</p> <p>（3）那么我们就可以在meta中设置no-referrer的方式来尝试</p> <pre data-index="14" class="set-code-show" name="code"><code class="language-html hljs language-xml"> <span class="hljs-tag"><<span class="hljs-name">meta</span> <span class="hljs-attr">name</span>=<span class="hljs-string">"referrer"</span> <span class="hljs-attr">content</span>=<span class="hljs-string">"no-referrer"</span>></span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>（4）再次访问</p> <h2><a name="t25"></a><img alt="" height="277" src="https://1000bd.com/contentImg/2023/11/19/195531711.png" ></h2> <p>成功访问</p> <h3 id="%E5%88%A9%E7%94%A8referrerpolicy%3D%22no-referrer%22" style="background-color:transparent;"><a name="t26"></a>利用referrerpolicy="no-referrer"</h3> <p>注：这种方式就是在script添加这样</p> <pre data-index="15" class="set-code-show" name="code"><code class="language-html hljs language-xml"> <span class="hljs-tag"><<span class="hljs-name">script</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"这里是一个js页面"</span> <span class="hljs-attr">Referrerpolicy</span>=<span class="hljs-string">"no-referrer"</span>></span></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>一句，呈现的效果和上面的meta一样，这里不再赘述</p> <h3 id="%E5%88%A9%E7%94%A8iframe%E4%BC%AA%E9%80%A0%E8%AF%B7%E6%B1%82referer" style="background-color:transparent;"><a name="t27"></a>利用iframe伪造请求referer</h3> <p>内容参考：<a href="https://juejin.cn/post/6844903892170309640" title="如何绕开referrer防盗链 - 掘金 (juejin.cn)">如何绕开referrer防盗链 - 掘金 (juejin.cn)</a></p> <p>（1）修改referrer1.html</p> <pre data-index="16" class="set-code-show" name="code"><code class="language-javascript hljs"> <img src=<span class="hljs-string">"https://t7.baidu.com/it/u=4162611394,4275913936&fm=193&f=GIF"</span> alt=<span class="hljs-string">"你这图有问题啊"</span>></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>（2）编辑test.js</p> <pre data-index="17" class="set-code-hide" name="code"><code class="language-javascript hljs"><ol class="hljs-ln" style="width:921px"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">function</span> <span class="hljs-title function_">showImg</span>(<span class="hljs-params">src, wrapper</span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">let</span> url = <span class="hljs-keyword">new</span> <span class="hljs-title function_">URL</span>(src);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">let</span> frameid = <span class="hljs-string">'frameimg'</span> + <span class="hljs-title class_">Math</span>.<span class="hljs-title function_">random</span>();</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-variable language_">window</span>.<span class="hljs-property">img</span> = <span class="hljs-string">`<img id="tmpImg" width=400 src="<span class="hljs-subst">${url}</span>" alt="图片加载失败，请稍后再试"/> `</span>;</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="6"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment">// 构造一个iframe</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="7"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe = <span class="hljs-variable language_">document</span>.<span class="hljs-title function_">createElement</span>(<span class="hljs-string">'iframe'</span>)</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="8"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">id</span> = frameid</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="9"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">src</span> = <span class="hljs-string">"javascript:parent.img;"</span> <span class="hljs-comment">// 通过内联的javascript，设置iframe的src</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="10"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment">// 校正iframe的尺寸，完整展示图片</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="11"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">onload</span> = <span class="hljs-keyword">function</span> (<span class="hljs-params"></span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="12"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">var</span> img = iframe.<span class="hljs-property">contentDocument</span>.<span class="hljs-title function_">getElementById</span>(<span class="hljs-string">"tmpImg"</span>)</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="13"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">if</span> (img) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="14"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">height</span> = img.<span class="hljs-property">height</span> + <span class="hljs-string">'px'</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="15"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">width</span> = img.<span class="hljs-property">width</span> + <span class="hljs-string">'px'</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="16"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> }</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="17"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> }</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="18"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">width</span> = <span class="hljs-number">200</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="19"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">height</span> = <span class="hljs-number">200</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="20"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">scrolling</span> = <span class="hljs-string">"no"</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="21"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> iframe.<span class="hljs-property">frameBorder</span> = <span class="hljs-string">"0"</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="22"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> wrap.<span class="hljs-title function_">appendChild</span>(iframe)</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="23"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">}</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="24"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-title function_">showImg</span>(<span class="hljs-string">'https://t7.baidu.com/it/u=4162611394,4275913936&fm=193&f=GIF'</span>, <span class="hljs-variable language_">document</span>.<span class="hljs-title function_">querySelector</span>(<span class="hljs-string">'#container'</span>));</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="25"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"></div></div></li></ol></code><div class="hide-preCode-box"><span class="hide-preCode-bt" data-report-view="{"spm":"1001.2101.3001.7365"}"><img class="look-more-preCode contentImg-no-view" src="https://1000bd.com/contentImg/2022/06/27/191644837.png" alt="" title=""></span></div><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>运行代码可以看见，通过这种方式也可以实现隐藏referer的功能，因此用作不支持<code>referrerPolicy</code>的一种替代方案。</p> <p>在某些不支持javascript内联运行的场景下，这种方案也是不可行的，比如在chrome扩展程序，由于<code>content_security_policy</code>，使用内联JavaScript会报错</p> <p>（3）测试</p> <h2><a name="t28"></a><img alt="" height="337" src="https://1000bd.com/contentImg/2023/11/19/195532326.png" ></h2> <p>成功盗用！</p> <h3 id="%E5%88%A9%E7%94%A8XMLHttpRequest" style="background-color:transparent;"><a name="t29"></a>利用XMLHttpRequest</h3> <p>XMLHttpRequest对象提供了<a href="https://link.juejin.cn/?target=https%3A%2F%2Fdeveloper.mozilla.org%2Fzh-CN%2Fdocs%2FWeb%2FAPI%2FXMLHttpRequest%2FsetRequestHeader" title="setRequestHeader">setRequestHeader</a>方法，用于向请求头添加或修改字段。我们能不能手动将修改 referer字段呢？</p> <p>（1）test.js</p> <pre data-index="18" class="set-code-hide" name="code"><code class="language-javascript hljs"><ol class="hljs-ln" style="width:859px"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-comment">// 通过ajax下载图片</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">function</span> <span class="hljs-title function_">loadImage</span>(<span class="hljs-params">uri</span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">return</span> <span class="hljs-keyword">new</span> <span class="hljs-title class_">Promise</span>(<span class="hljs-function"><span class="hljs-params">resolve</span> =></span> { <span class="hljs-comment">//使用异步下载 </span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">let</span> xhr = <span class="hljs-keyword">new</span> <span class="hljs-title class_">XMLHttpRequest</span>(); <span class="hljs-comment">//实例化xmlhttprequest</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> xhr.<span class="hljs-property">responseType</span> = <span class="hljs-string">"blob"</span>; <span class="hljs-comment">//响应类型为blob（二进制）</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="6"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> xhr.<span class="hljs-property">onload</span> = <span class="hljs-keyword">function</span> (<span class="hljs-params"></span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="7"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-title function_">resolve</span>(xhr.<span class="hljs-property">response</span>);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="8"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> };</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="9"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="10"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> xhr.<span class="hljs-title function_">open</span>(<span class="hljs-string">"GET"</span>, uri, <span class="hljs-literal">true</span>);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="11"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> xhr.<span class="hljs-title function_">setRequestHeader</span>(<span class="hljs-string">"Referer"</span>, <span class="hljs-string">""</span>);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="12"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment">// 通过setRequestHeader设置header不会生效</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="13"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> xhr.<span class="hljs-title function_">send</span>();</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="14"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> });</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="15"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">}</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="16"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="17"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-comment">// 将下载下来的二进制大对象数据转换成base64，然后展示在页面上</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="18"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">function</span> <span class="hljs-title function_">handleBlob</span>(<span class="hljs-params">blob</span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="19"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">let</span> reader = <span class="hljs-keyword">new</span> <span class="hljs-title class_">FileReader</span>();</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="20"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> reader.<span class="hljs-property">onload</span> = <span class="hljs-keyword">function</span> (<span class="hljs-params">evt</span>) { <span class="hljs-comment">//监听事件</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="21"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">let</span> img = <span class="hljs-variable language_">document</span>.<span class="hljs-title function_">createElement</span>(<span class="hljs-string">'img'</span>);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="22"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> img.<span class="hljs-property">src</span> = evt.<span class="hljs-property">target</span>.<span class="hljs-property">result</span>;</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="23"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-variable language_">document</span>.<span class="hljs-title function_">getElementById</span>(<span class="hljs-string">'container'</span>).<span class="hljs-title function_">appendChild</span>(img)</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="24"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> };</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="25"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> reader.<span class="hljs-title function_">readAsDataURL</span>(blob);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="26"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">}</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="27"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="28"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">const</span> imgSrc = <span class="hljs-string">"https://profile-avatar.csdnimg.cn/8f0b72eabecc42df84ef2cce29ed569a_qq_68163788.jpg!1"</span>;</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="29"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-title function_">loadImage</span>(imgSrc).<span class="hljs-title function_">then</span>(<span class="hljs-function"><span class="hljs-params">blob</span> =></span> {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="30"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-title function_">handleBlob</span>(blob);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="31"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">});</div></div></li></ol></code><div class="hide-preCode-box"><span class="hide-preCode-bt" data-report-view="{"spm":"1001.2101.3001.7365"}"><img class="look-more-preCode contentImg-no-view" src="https://1000bd.com/contentImg/2022/06/27/191644837.png" alt="" title=""></span></div><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>（2）referrer1.html</p> <pre data-index="19" class="set-code-show" name="code"><code class="language-javascript hljs"><ol class="hljs-ln" style="width:100%"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><div id=<span class="hljs-string">"container"</span>>aaa</div></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="language-xml"><span class="hljs-tag"><<span class="hljs-name">script</span> <span class="hljs-attr">src</span>=<span class="hljs-string">"./test.js"</span>></span><span class="hljs-tag"></<span class="hljs-name">script</span>></span></span></div></div></li></ol></code><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p>（3）测试</p> <h2><a name="t30"></a><img alt="" height="257" src="https://1000bd.com/contentImg/2023/11/19/195532235.png" ></h2> <p> 上述代码运行时会发现控制台提示错误</p> <h2><a name="t31"></a><img alt="" height="262" src="https://1000bd.com/contentImg/2023/11/19/195531985.png" ></h2> <p>根据结果可以看出，浏览器拒绝将Rerrer置为空</p> <p>可以看见setRequestHeader设置referer响应头是无效的，这是由于浏览器为了安全起见，无法手动设置部分保留字段，不幸的是Referer恰好就是保留字段之一，详情列表参考Forbidden header name。</p> <p>可见使用xmlhttprequest提供的方法用AJAX同源请求无法完成这一操作。</p> <p>使用fetch可以解决这一问题。</p> <h3 id="%E5%88%A9%E7%94%A8fetch"><a name="t32"></a>利用fetch</h3> <p><a href="https://link.juejin.cn?target=https%3A%2F%2Fdeveloper.mozilla.org%2Fzh-CN%2Fdocs%2FWeb%2FAPI%2FFetch_API%2FUsing_Fetch" title="Fetch">Fetch</a>是浏览器提供的一个全新的接口，<strong>用于访问和操作HTTP管道部分</strong>，例如请求和响应，该接口支持<code>referrerPolicy</code>，因此也可以用来操作referer。</p> <pre data-index="20" class="set-code-hide" name="code"><code class="language-javascript hljs"><ol class="hljs-ln" style="width:713px"><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="1"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-comment">// 将下载下来的二进制大对象数据转换成base64，然后展示在页面上</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="2"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">function</span> <span class="hljs-title function_">handleBlob</span>(<span class="hljs-params">blob</span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="3"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">let</span> reader = <span class="hljs-keyword">new</span> <span class="hljs-title class_">FileReader</span>();</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="4"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> reader.<span class="hljs-property">onload</span> = <span class="hljs-keyword">function</span> (<span class="hljs-params">evt</span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="5"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">let</span> img = <span class="hljs-variable language_">document</span>.<span class="hljs-title function_">createElement</span>(<span class="hljs-string">'img'</span>);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="6"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> img.<span class="hljs-property">src</span> = evt.<span class="hljs-property">target</span>.<span class="hljs-property">result</span>;</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="7"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-variable language_">document</span>.<span class="hljs-title function_">getElementById</span>(<span class="hljs-string">'container'</span>).<span class="hljs-title function_">appendChild</span>(img)</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="8"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> };</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="9"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> reader.<span class="hljs-title function_">readAsDataURL</span>(blob);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="10"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">}</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="11"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="12"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">const</span> imgSrc = <span class="hljs-string">"https://img-blog.csdnimg.cn/5ff039c8a8cd47c98e26d694854e8962.jpeg"</span>;</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="13"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="14"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="15"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-keyword">function</span> <span class="hljs-title function_">fetchImage</span>(<span class="hljs-params">url</span>) {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="16"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-keyword">return</span> <span class="hljs-title function_">fetch</span>(url, {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="17"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-attr">headers</span>: {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="18"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment">// "Referer": "", // 这里设置无效</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="19"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> },</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="20"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-attr">method</span>: <span class="hljs-string">"GET"</span>,</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="21"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-attr">referrer</span>: <span class="hljs-string">""</span>, <span class="hljs-comment">// 将referer置空</span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="22"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-comment">// referrerPolicy: 'no-referrer', </span></div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="23"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> }).<span class="hljs-title function_">then</span>(<span class="hljs-function"><span class="hljs-params">response</span> =></span> response.<span class="hljs-title function_">blob</span>());</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="24"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">}</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="25"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> </div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="26"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"><span class="hljs-title function_">fetchImage</span>(imgSrc).<span class="hljs-title function_">then</span>(<span class="hljs-function"><span class="hljs-params">blob</span> =></span> {</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="27"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line"> <span class="hljs-title function_">handleBlob</span>(blob);</div></div></li><li><div class="hljs-ln-numbers"><div class="hljs-ln-line hljs-ln-n" data-line-number="28"></div></div><div class="hljs-ln-code"><div class="hljs-ln-line">});</div></div></li></ol></code><div class="hide-preCode-box"><span class="hide-preCode-bt" data-report-view="{"spm":"1001.2101.3001.7365"}"><img class="look-more-preCode contentImg-no-view" src="https://1000bd.com/contentImg/2022/06/27/191644837.png" alt="" title=""></span></div><div class="hljs-button signin" data-title="登录后复制" data-report-click="{"spm":"1001.2101.3001.4334"}" onclick="hljs.signin(event)"></div></pre> <p><img alt="" height="311" src="https://1000bd.com/contentImg/2023/11/19/195531146.png" > </p> <p>通过将配置参数<code>redirect</code>置位空，可以看见本次请求已经不带referer了。</p> </div> </div> </li> <li class="list-group-item ul-li"> <b>相关阅读:</b><br> <nobr> <a href="/Article/Index/858448">Java刷题day37</a> <br /> <a href="/Article/Index/647037">RabbitMQ之交换机</a> <br /> <a href="/Article/Index/661727">tableau 处理MySql 的bug：时间列被自动加上一个月</a> <br /> <a href="/Article/Index/613975">java中的interface(接口)</a> <br /> <a href="/Article/Index/936076">C++ “链链“不忘@必有回响之单链表</a> <br /> <a href="/Article/Index/808853">【自动驾驶多传感器融合+多算法融合】</a> <br /> <a href="/Article/Index/767704">基于混沌搜索策略的鲸鱼优化算法-附代码</a> <br /> <a href="/Article/Index/1667842">c#与汇川plc通信</a> <br /> <a href="/Article/Index/768037">【语义分割】FCN</a> <br /> <a href="/Article/Index/799195">python --机器学习(基本算法详解)</a> <br /> </nobr> </li> <li class="list-group-item from-a mb-2"> 原文地址：https://blog.csdn.net/qq_68163788/article/details/134330394 </li> </ul> </div> <div class="col-lg-4 col-sm-12"> <ul class="list-group" style="word-break:break-all;"> <li class="list-group-item ul-li-bg" aria-current="true"> 最新文章 </li> <li class="list-group-item ul-li"> <nobr> <a href="/Article/Index/1484446">攻防演习之三天拿下官网站群</a> <br /> <a href="/Article/Index/1515268">数据安全治理学习——前期安全规划和安全管理体系建设</a> <br /> <a href="/Article/Index/1759065">企业安全 | 企业内一次钓鱼演练准备过程</a> <br /> <a href="/Article/Index/1485036">内网渗透测试 | Kerberos协议及其部分攻击手法</a> <br /> <a href="/Article/Index/1877332">0day的产生 | 不懂代码的"代码审计"</a> <br /> <a href="/Article/Index/1887576">安装scrcpy-client模块av模块异常，环境问题解决方案</a> <br /> <a href="/Article/Index/1887578">leetcode hot100【LeetCode 279. 完全平方数】java实现</a> <br /> <a href="/Article/Index/1887512">OpenWrt下安装Mosquitto</a> <br /> <a href="/Article/Index/1887520">AnatoMask论文汇总</a> <br /> <a href="/Article/Index/1887496">【AI日记】24.11.01 LangChain、openai api和github copilot</a> <br /> </nobr> </li> </ul> <ul class="list-group pt-2" style="word-break:break-all;"> <li class="list-group-item ul-li-bg" aria-current="true"> 热门文章 </li> <li class="list-group-item ul-li"> <nobr> <a href="/Article/Index/888177">十款代码表白小特效 一个比一个浪漫 赶紧收藏起来吧！！！</a> <br /> <a href="/Article/Index/797680">奉劝各位学弟学妹们，该打造你的技术影响力了！</a> <br /> <a href="/Article/Index/888183">五年了，我在 CSDN 的两个一百万。</a> <br /> <a href="/Article/Index/888179">Java俄罗斯方块，老程序员花了一个周末，连接中学年代！</a> <br /> <a href="/Article/Index/797730">面试官都震惊，你这网络基础可以啊！</a> <br /> <a href="/Article/Index/797725">你真的会用百度吗？我不信 — 那些不为人知的搜索引擎语法</a> <br /> <a href="/Article/Index/797702">心情不好的时候，用 Python 画棵樱花树送给自己吧</a> <br /> <a href="/Article/Index/797709">通宵一晚做出来的一款类似CS的第一人称射击游戏Demo！原来做游戏也不是很难，连憨憨学妹都学会了！</a> <br /> <a href="/Article/Index/797716">13 万字 C 语言从入门到精通保姆级教程2021 年版</a> <br /> <a href="/Article/Index/888192">10行代码集2000张美女图，Python爬虫120例，再上征途</a> <br /> </nobr> </li> </ul> </div> </div> </div> <!-- 主体 --> <!--body结束--> <!--这里是footer模板--> <!--footer--> <nav class="navbar navbar-inverse navbar-fixed-bottom"> <div class="container"> <div class="row"> <div class="col-md-12"> <div class="text-muted center foot-height"> Copyright © 2022 侵权请联系<a href="mailto:2656653265@qq.com">2656653265@qq.com</a> <a href="https://beian.miit.gov.cn/" target="_blank">京ICP备2022015340号-1</a> </div> <div style="width:300px;margin:0 auto; padding:0px 5px;"> <a href="/regex.html">正则表达式工具</a> <a href="/cron.html">cron表达式工具</a> <a href="/pwdcreator.html">密码生成工具</a> </div> <div style="width:300px;margin:0 auto; padding:5px 0;"> <a target="_blank" href="http://www.beian.gov.cn/portal/registerSystemInfo?recordcode=11010502049817" style="display:inline-block;text-decoration:none;height:20px;line-height:20px;"> <img src="" style="float:left;" /><p style="float:left;height:20px;line-height:20px;margin: 0px 0px 0px 5px; color:#939393;">京公网安备 11010502049817号</p></a> </div> </div> </div> </div> </nav> <!--footer--> <!--footer模板结束--> <script src="/js/plugins/jquery/jquery.js"></script> <script src="/js/bootstrap.min.js"></script> <!--这里是scripts模板--> <!--scripts模板结束--> </body> </html>