Hacker News Reader

Comment by honoredb | Hacker News Reader

Fun! Level 6 failed to load any widgets, evil or otherwise, in Chrome; I had to switch to Firefox and redo the whole test. For my external script I used http://pastebin.com/raw.php?i=15S5qZs0, although I don't think the lack of a .js extension there was the problem.

View on HN

I hope this isn't a spoiler, but remember there are other ways to load resources without an external request. You can pass that stage without any requests to external servers.

Care to spoil how? I used an external server (Dropbox), but I'd love to know how to do it without.

SpoilersrandomletterssdataurlSpoilermorerandemletters

I had to manually remove the https:// in front of the URL for it to work. The following error is:

[blocked] The page at 'xss-game' was loaded over HTTPS, but ran insecure content from 'script-url': this content should also be loaded over HTTPS.

got the same problem, it only works with a https address !

Nope. Works even if you use an address without http, but beginning with only "//"

In that example "//" is just another way to say "https://", though.

I had the same issue, I think it depends on browser configuration. Some browsers disallow http content on https pages.

The regex is case sensitive. That's how I solved it.

haha so obvious yet I completely missed that! I went with a protocol-relative url [0]

[0] http://www.paulirish.com/2010/the-protocol-relative-url/

Weird. It worked fine for me in chrome.

Reply on news.ycombinator.com