Refused to Execute a JavaScript Script. Source Code of Script Found Within Request

Refused to execute a JavaScript script. Source code of script found within request

It's a security measure to prevent XSS (cross-site scripting) attacks.

This happens when some JavaScript code is sent to the server via an HTTP POST request, and the same code comes back via the HTTP response. If Chrome detects this situation, the script is refused to run, and you get the error message Refused to execute a JavaScript script. Source code of script found within request.

Also see this blogpost about Security in Depth: New Security Features.

PHP Security and XSS attacks - Getting Error Refused to execute a JavaScript script. Source code of script found within request

When I tried this in Chrome I saw an error in the console:

Refused to execute a JavaScript script. Source code of script found within request.

So it's possible modern browsers do this check to prevent it. You should continue to sanitize your input regardless of course, but check your console and you will probably see this.

Twitter API: refused to execute a javascript

I fixed the issue myself by using a local JavaScript to parse the tweet. I downloaded the blogger.js, modified a bit (removed some styles) and uploaded it to my server. Now it's working like a charm.

Refused to execute script, strict MIME type checking is enabled?

You have a <script> element that is trying to load some external JavaScript.

The URL you have given it points to a JSON file and not a JavaScript program.

The server is correctly reporting that it is JSON so the browser is aborting with that error message instead of trying to execute the JSON as JavaScript (which would throw an error).

---

Odds are that the underlying reason for this is that you are trying to make an Ajax request, have hit a cross origin error and have tried to fix it by telling jQuery that you are using JSONP. This only works if the URL provides JSONP (which is a different subset of JavaScript), which this one doesn't.

The same URL with the additional query string parameter callback=the_name_of_your_callback_function does return JavaScript though.

---

Related Topics