{"action":"created","issue":{"url":"https://api.github.com/repos/cefsharp/CefSharp/issues/845","labels_url":"https://api.github.com/repos/cefsharp/CefSharp/issues/845/labels{/name}","comments_url":"https://api.github.com/repos/cefsharp/CefSharp/issues/845/comments","events_url":"https://api.github.com/repos/cefsharp/CefSharp/issues/845/events","html_url":"https://github.com/cefsharp/CefSharp/issues/845","id":58912338,"number":845,"title":"Inject JavaScript without exec/evaluate? (CORS)","user":{"login":"rfgamaral","id":96476,"avatar_url":"https://avatars.githubusercontent.com/u/96476?v=3","gravatar_id":"","url":"https://api.github.com/users/rfgamaral","html_url":"https://github.com/rfgamaral","followers_url":"https://api.github.com/users/rfgamaral/followers","following_url":"https://api.github.com/users/rfgamaral/following{/other_user}","gists_url":"https://api.github.com/users/rfgamaral/gists{/gist_id}","starred_url":"https://api.github.com/users/rfgamaral/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfgamaral/subscriptions","organizations_url":"https://api.github.com/users/rfgamaral/orgs","repos_url":"https://api.github.com/users/rfgamaral/repos","events_url":"https://api.github.com/users/rfgamaral/events{/privacy}","received_events_url":"https://api.github.com/users/rfgamaral/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cefsharp/CefSharp/labels/faq-able!","name":"faq-able!","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-25T14:51:31Z","updated_at":"2015-02-26T16:17:42Z","closed_at":null,"body":"I first tried `ExecuteScriptAsync` as soon as the page was loaded but this didn't work for my scenario where I need to decorate some method that was already executed after the `ExecuteScriptAsync` injection.\r\n\r\nI solved this issue by handling `GetResourceHandler`, listen for a specific JS file to be request and concat my code to the end of that file. This almost worked at first but I was given the CORS error as soon as I tried to intercept JS requests and download the files myself.\r\n\r\nAfter researching for a bit, I found `BrowserSettings.WebSecurityDisabled` and set it to `true`. No more CORS error and my script was injected and ran sucessfully.\r\n\r\nMy question now becomes. Is there something wrong with this approach? Can I solve my problem any other [better] way? Or is this OK?"},"comment":{"url":"https://api.github.com/repos/cefsharp/CefSharp/issues/comments/76207502","html_url":"https://github.com/cefsharp/CefSharp/issues/845#issuecomment-76207502","issue_url":"https://api.github.com/repos/cefsharp/CefSharp/issues/845","id":76207502,"user":{"login":"rassilon","id":698352,"avatar_url":"https://avatars.githubusercontent.com/u/698352?v=3","gravatar_id":"","url":"https://api.github.com/users/rassilon","html_url":"https://github.com/rassilon","followers_url":"https://api.github.com/users/rassilon/followers","following_url":"https://api.github.com/users/rassilon/following{/other_user}","gists_url":"https://api.github.com/users/rassilon/gists{/gist_id}","starred_url":"https://api.github.com/users/rassilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rassilon/subscriptions","organizations_url":"https://api.github.com/users/rassilon/orgs","repos_url":"https://api.github.com/users/rassilon/repos","events_url":"https://api.github.com/users/rassilon/events{/privacy}","received_events_url":"https://api.github.com/users/rassilon/received_events","type":"User","site_admin":false},"created_at":"2015-02-26T16:17:42Z","updated_at":"2015-02-26T16:17:42Z","body":"The CEF documentation for the function and the CEF unit tests explain this a bit better.\r\n\r\nIn the whitelist function:\r\n* Source means: The domain you're trying to access\r\n* Target means: The domain you're trying to access source *FROM*\r\n\r\nSo, if you had a Netflix API key for example you might want to do this:\r\n\r\n            Cef.AddCrossOriginWhitelistEntry(\"https://netflix.com\", \"https\", \"mydomain.com\", true);\r\n\r\nThe target domain can be String.Empty, but that means ANY web page that gets rendered can successfully do a cross-domain request to netflix.com.\r\n\r\nFyi,\r\nBill"}}