52

The same origin policy is a wholly client-based restriction, and is primarily engineered to protect users, not services. All or most browsers include a command-line switch or configuration option to to turn it off. The SOP is like seat belts in a car: they protect the rider in the car, but anyone can freely choose not to use them. Certainly don't expect a ...


7

The same-origin policy is enforced on the client-side. If the browser supports CORS, the server can send back headers that tell the browser to make exceptions to the same-origin policy. For example, sending the header Access-Control-Allow-Origin: www.example.com would tell the browser to allow cross-origin requests from www.example.com. Access-Control-...


5

CORS (Cross-Origin Resource Sharing) Simply allowing javascript to access any network resource is Not a Good Idea TM. Usually javascript is downloaded from a server (not here but out there), but it runs locally (where all my private things are). Originally the policy was to just allow the javascript to only talk to the server it was downloaded from. But this ...


5

Some naming guidelines make a distinction between "short" and "long" acronyms. For instance, the coding style guide for Microsoft's .Net runtime specifies that short acronyms should be in block caps while long acronyms should only have the first letter capitalized. Their threshold for a long acronym is 3 letters, so would favor "XmlHttpRequest", however it ...


4

I don't think there is anything wrong with it, per se, but XmlHttpRequests does it better. Before Ajax, javascript was extremely limited. There was no real way to query a database, so you either had to frontload all the data you might need (with the attendant performance hit), or you had to make all the same data available through an external page, with ...


3

Web servers generally prevent attacks of this sort by checking the (infamously misspelled) Referer line in the HTTP header, to ensure that a request is coming from a page on their own site. There's no good way to guard against a malicious client, but that's not how XSRF attacks work. The client isn't malicious; it's generally an ordinary user who's been ...


2

Short answer no. If your posting back to a https server in one and http in another then yes https is more secure. They do the same things internally but are triggered differently and lead to different outcomes. Ajax (xmlHttpRequest ) returns some text - xml or plain by calling a javascript function in same page; a form post navigates to a new page - could ...


2

Because that's not allowed in Javascript. Javascript runs in a sandboxed environment; there are a lot of things you are not allowed to do there, such as write to the user's file system. You can write to the file system in C. The difference is that you won't be running your C program in millions of people's browsers. If you have access to the server in ...


2

Wikipedia has a suitable definition for Middleware. It says: Middleware is the software that connects software components or enterprise applications. [It] is the software layer that lies between the operating system and the applications on each side of a distributed computer network. Typically, it supports complex, distributed business software ...


1

What you're describing is a reverse proxy. CORS allows cross-origin reading of resources, but it does not allow cross-origin iframe reads. However, if your reverse proxy serves permissive CORS headers (e.g., Access-Control-Allow-Origin: *), then the contents of your reverse proxy will be readable with an Ajax request. You simply need to make an Ajax request ...


1

Do not invent your own headers. And please avoid using headers to detect which content you should serve. There are legitimate use cases for this, but in general this makes your backend much more difficult to debug. The full-page and modal variant of the page represent the same resource‚Äč, so it can be argued that they should have the same URL. Using a query ...


1

A video is a sequence of framed images that are displayed at a rate one after another. If we had all frames of a video clip in our browser, we could display them one after another at a frame rate and there we had our video playing! This sounds like a plan, let us see how we can translate this into an actual web application. From what we planned, we divide ...


1

billions of websites are using various techniques for streaming their videos to fit the user needs (Internet connection, browser, OS version) are playing a vital role for which technique the server will try to use. Despite I've made a complete video conference that is working using OpenTok, I am not sure how it works with AJAX Requests, also please note ...


1

A quick search found: http://code.tutsplus.com/tutorials/http-headers-for-dummies--net-8039 (no offense from the title; it looked like a pretty thorough article) Skip down to "HTTP Headers in HTTP Requests" Just eyeballing the list, the most important headers are for "content negotiation": Content-Type Most servers will need this to parse & route your ...


1

How do web servers enforce the same-origin policy? In short, they do not, as apsillers and Dirk pointed out. One important reason is that the ACAO header protects the servers themselves from rampant DDOS, - Distributed Denial of Service- attacks. Who: The ACAO as a HTTP response-header is meant for the web client to be interpreted, operating under the ...


1

Here is a good reason not to totally abandon sync calls just yet. You have just downloaded a new tool from a vendor. You get it working in your AngularJS application. (you spend weeks at this POC) Then you are asked to use one option that has to communicate to your web server. You create OWIN secure applications, so ALL calls must be Authorized! The ...


Only top voted, non community-wiki answers of a minimum length are eligible