[BUG] @Connect * does not bypass "Script is attempting to access a cross-origin resource" popup #623

Activity

1. fireattack

   added

   bugSomething isn't workingSomething isn't working

   on Aug 13, 2025
2. fireattack

   changed the title [-][BUG] @Connect * does not bypass "Script is attempting to access a cross-origin resource" option[/-] [+][BUG] @Connect * does not bypass "Script is attempting to access a cross-origin resource" popup[/+] on Aug 13, 2025
3. CodFrm

   added a commit that references this issue on Aug 13, 2025

   🐛 修复@connect *不生效的问题 #623

   76481c8
4. CodFrm commented on Aug 13, 2025

   

   CodFrm

   on Aug 13, 2025

   Member

   More actions

   fix by: https://github.com/scriptscat/scriptcat/actions/runs/16931060104

   Temporary solution:

   1. Script Settings

   

   2. Permission Management

   

   3. Add *

   

   🚀React with 🚀1Reacted by fireattack
5. CodFrm

   closed this as completedon Aug 13, 2025
6. CodFrm

   marked [Bug] Allow an userscript access to all cross-origin requests for all domains/websites (Pagetual) #625 as a duplicate of this issue on Aug 14, 2025
7. CodFrm

   added a commit that references this issue on Aug 16, 2025

   🐛 修复@connect *不生效的问题 #623

   ...

   744c182
8. hmjz100 commented on Aug 20, 2025

   

   hmjz100

   on Aug 20, 2025

   Last edited by hmjz100

   More actions

   在 Tampermonkey 中，使用 @connect * 仅对本地地址（如 127.0.0.1、localhost 等）默认免提示放行，
   而对于未显式声明但有 @connect * 并实际访问的外部地址（如 api.bilibili.com），仍会向用户弹窗。

   完全不提示的话不安全吧？应该加一个设置选项给用户决定非本地地址是否提示才是

   // ==UserScript==
   // @name         跨域示例
   // @namespace    http://tampermonkey.net/
   // @version      0.1
   // @description  Example
   // @author       You
   // @match        https://*.example.com/*
   // @grant        GM_xmlhttpRequest
   // @connect      *
   // ==/UserScript==
   
   (function() {
       'use strict';
   
       // 这么写不会弹窗
       GM_xmlhttpRequest({
           method: 'GET',
           url: 'http://127.0.0.1',
           ...
       });
       
       // 这么写会弹窗（除非声明了 `@connect example.com` 或者用户关闭了提示）
       // 虽然这也有可能会被发送 cookie 到陌生服务器，但是这样至少可以让用户知晓脚本 `@connect` 了那些域名
       // 脚本安装页面应明显显示用户脚本 `@connect` 的域名
       GM_xmlhttpRequest({
           method: 'GET',
           url: 'https://api.example.com',
           ...
       });
   })();
   
9. CodFrm commented on Aug 21, 2025

   

   CodFrm

   on Aug 21, 2025

   Member

   More actions

   @hmjz100 确实如此会更好一些，可以先开个新issue记录一下