Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need a javascript form filler that can bypass the 'same origin policy' most modern browsers implement.

I made a script that opens the desired website/form in a new browser. With the handler, returned by the method, I want to retrieve the inputs with theWindowHandler.document.getElementById('inputx') and fill them (access denied).

Is it possible to solve this problem by using Isapi Rewrite (official site) in IIS 6 acting like a reverse proxy? If so, how would I configure the reverse proxy?

This is how far I got:

RewriteEngine on
RewriteLogLevel 9
LogLevel debug 

RewriteRule CarChecker$1 [NC,P]

The rewrite works,, as evident in the logging. From within our companysite I can run the carchecker as if it was in our own domain. Except, the 'same origin policy' is still in force.



share|improve this question
What makes you think the same-policy restrictions are still in effect? Are you getting any security errors in your browser? – Mark Henderson Sep 22 '10 at 10:13
I get an access denied error when I try to fill the form fields. – Michel van Engelen Sep 23 '10 at 7:13

While still a bit fuzzy on the details (which browser for example, and which domain is hosting the original call to and what the new domain is)...

You might be approaching this from the wrong angle. While a reverse proxy could in theory be used to assist in the cross-domain issues, there are going to be a ton of problems in getting this right. You will be fixing a never ending stream of problems with the content being modified and other things you can't even begin to imagine. And it is just generally a bad idea to try a circumvent the browser security in this way. I would strongly recommend going down one of two routes:

1) Purchase some software like RoboForm that functions as an add-on to your browser, and isn't limited to the security model inside the browser.

2) Rewrite some of your JavaScript logic in Bookmarklets and JSONP requests. Look at how the "Note in Google Reader" or the "Note in Evernote" bookmarklets (or chrome extensions) do it - this is basically what you are going to need to do.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.