I was looking at cross-domain requests for a design and stumbled upon something that puzzles me. From a local site I'm firing an Ajax request to another domain (with jQuery and vanilla XMLHttpRequest). Sure, the request fails and I can only get a fail event, which seems perfectly normal du to same-origin policy. But I noticed in Fiddler that the request is actually made and succeeds! It's seems that it's just that I can't process the response.
Am I missing something, or is that a security hole? Sure, you can't access data, but what's the point of allowing sending data and just preventing response access?