Refused to set unsafe header

*** If interested in CORS, try this.

This is an annoying little error that I've seen some people mention and even ran into with JavaScript. Moreover, it appears only in Webkit based browsers. So what's the problem? Basically a browser like Google Chrome will not change certain http headers in an XMLHttpRequest using setRequestHeader(). This is not a problem in Firefox or Opera from my testing so far. According to W3, it is actually the behavior they have as "standard" in their working draft. Headers they don't want you to overwrite are

"

• Accept-Charset
• Accept-Encoding
• Access-Control-Request-Headers
• Access-Control-Request-Method
• Connection
• Content-Length
• Cookie
• Cookie2
• Date
• DNT
• Expect
• Host
• Keep-Alive
• Origin
• Referer
• TE
• Trailer
• Transfer-Encoding
• Upgrade
• User-Agent
• Via

Or if the start of header is a case-insensitive match for Proxy- or Sec- (including when header is just Proxy- or Sec-)."^[1]

Now as to where this could be a problem, for me at least, is when I am trying to spoof some headers and want to do so in a browser as apposed to writing a script or getting an addon to do so for me. However, there is a security risk it could open up called HTTP Request Smuggling. As to how one would pull it off, I think an XSS vulnerability would need to be there as well for this in JavaScript to do anything. Bottom line for the security of it on the design end, make sure you check your sources before you use things like external scripts. As for user-end security, just be careful what sites you go to and use some common sense when you can.

Now as for ways around this, you would need either an addon to modify this for you or use related command line arguments. For example, to change the User-Agent header, you launch Chrome from your terminal with the option --user-agent="Some new UA string". As for an addon to do this, I do not know of any or if it is even possible, but if I find something I will update that here.

*[1] - http://www.w3.org/TR/XMLHttpRequest/#the-setrequestheader-method

WebGL Firefox Error

So I figured I'd post about this, since I ran into a problem and had to dig through some forum posts to find how to fix this. My problem was on Ubuntu 10.04 LTS using Firefox 12.0, with NVIDIA GeForce Go 6150. Trying to use WebGL gave me the error that I forgot to save because I'm smart like that.

Anyway, the quick fix was to enter in your url about:config, then search for WebGL, then enable webgl.force-enabled. No idea if it will cause any problems, but for now it works.

***Edit:
Updated to Ubuntu 12.04 LTS, same settings and everything and now WebGL just refuses to work at all. No solution found yet, all the ones that I tried did absolutely nothing.

2D Rectangular Collison Detection

I was just looking through some old code and came across something I couldn't quite work out in my head but had to find. Circles was very self explanatory, but rectangular shapes are a bit more awkward, so here's a simple way that will return either a true or false based on the idea that 0 is false and a number greater than 0 is true, assuming rectangle 1 is made of points a and b and rectangle 2 is made of points c and d.

Points relative to rectangle (showing collision)

We also assume each point is a list of the [x, y].

int checkCollision(int a[], int b[], int c[], int d[]) {
    int c1, c2, c3, c4, c5;
    c1 = a[0] < d[0];
    c2 = a[1] < d[1];
    c3 = b[0] > c[0];
    c4 = b[1] > c[1];
    c5 = c1 && c2 && c3 && c4;
    return c5;
}

That would (more or less) be the gist of detecting if 2 rectangles collide by finding if there is an overlap. The basic idea is make sure all the points are in an area they could  be in if there was an overlap. Then by making sure all are in an area they can be in if there is an overlap, detects the overlap, since all must be in those areas for an overlap to exist. For any other shapes that are not square, you must use trigonometry, which I may get into some day down the road.

Minecraft /dev/input/event error

I've been playing Minecraft for a while, and having a computer with Ubuntu, that's what I play it on. However I kept running into a series of error messages about /dev/input/event. Since everything ran fine, I never bothered to see what the error was about. Today I finally searched around and it was a problem with file permissions. A quick command to fix it is sudo chmod go=u /dev/input/event*.

A quick explanation of what it does if you don't understand it, it will copy the permissions for the root (u)ser to the (g)roup and (o)ther, other being anyone else not in the group or that user.

CSS3 ::selection

While working on some stuff I cam across a CSS3 pseudo-class selector called ::selection. While this is something you can do in javascript, it makes things a lot easier when styling can all be done in CSS rather than javascript workarounds. The javascript equivalent would be rather annoying to do. So the CSS3 way, as with any CSS, is rather simple and quick to do, minus a few catches here and there. CSS3 still lacks a good deal of support and isn't good if you want some real backwards compatibility, however I'm more interested in how to use this to just screw with things in ways it could be exploited, bad or just annoying and this particular property hit right on the head for some annoying fun.

You may wonder how this could be annoying, and quite simply, think about what would happen if selected text disappears. It would no longer be selected and then have to reappear, unselected. Thus the end result is text you cannot highlight without altering the CSS. So the code for that looks something like this.

::selection {
  display: none;
}
::-moz-selection {
  display: none;
}

I've only tried this in Firefox 10, but when I do it on Firefox, the text is impossible to highlight, however I can drag the text. As to the effects it will have in other browsers that support it, well that's all part in the fun in trying to mess with things to get results like this.

Try to highlight this and see what happens if your browser supports it.