Do subdomains have some cross-browser restrictions when invoking web services from Javascript?

The scenario is this:

This does not work at the moment. I suspect the subdomain is violating the restriction in the browser. Any ideas?

It works locally when the html page and web service are disconnected from my local host.

Greetings.

+4
source share
2 answers

In the same origin policy , the host must exactly match (so it should have a protocol and port, but that's aloof). If a sufficient suffix can be sufficient, foo.com will be considered "the same origin" as bar.com , or fie.co.uk in the same way as flap.co.uk , etc., completely destroying the purpose of the policy.

I understand what you think of www.blah.com as being β€œcloser” to whatever.blah.com than the examples I gave, but it’s just not so - think of all the countless something.appspot.com domains on which launched Google App Engine applications from myriads, for example, from different authors who have absolutely no connection.

+1
source

Can you make a JSONP service or use .NET as a proxy?

Otherwise, you do not agree with the same origin policy.

0
source

Source: https://habr.com/ru/post/1311816/


All Articles