0

Why do browsers disallow cross-domain AJAX requests, while JavaScript/ CSS files can be retrieved from other domains without issue?

I know there are ways to solve this, but I want to know what factors made browsers prevent cross-domain AJAX calls.

If any JavaScript or CSS file can be accessed via <script> or <link> tag, why is the same content not accessible via AJAX call? Why are cross-domain link/ script tags allowed and not AJAX?

zcoop98
  • 2,590
  • 1
  • 18
  • 31
Ratnesh Lal
  • 401
  • 4
  • 8
  • 18

1 Answers1

3

this is for user safety :

Assume you are logged into Facebook and visit a malicious website in another browser tab. Without the same origin policy JavaScript on that website could do anything to your Facebook account that you are allowed to do. For example read private messages, post status updates, analyse the HTML DOM-tree after you entered your password before submitting the form.

from here

Update :

1- when you target a file using script or link or img tag , you are downloading the file from its server and then its operation is limited to your domain context(access your DOM, manipulate your DOM ...).

2- but when you want to do a ajax call to another website, you potentially have ability to make changes to that website. So to avoid this risk, browser checks your request with the website and gets its response. if it's no, then browser rejects your request and if it's yes then it passes your request to the server.in other hand it's the target website that allows or rejects Cross-Origin Requests.

3- it's not just about Ajax but also webSocket or even Flash.

Community
  • 1
  • 1
mohsen dorparasti
  • 8,107
  • 7
  • 41
  • 61
  • " For example read private messages, post status updates," - this are the part should be taken care by facebook authentication. Any ajax call from facebook domain also need authentication. My question is if any javascript file or css which can be accessed via script or link html tag why it is not accessible via ajax call? Why cross-domain link/script tag is allowed and not ajax? – Ratnesh Lal Aug 26 '14 at 06:28