Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

I thought cross-subdomain AJAX requests were allowed, but this Chrome error seems to indicate otherwise

I know that cross-domain requests are disallowed for security reasons, but I was under the impression that only the top-level domain needed to match, that different sub-domains were okay. However, I am getting this error from Chrome 7:

"Unsafe JavaScript attempt to access frame with URL http://foo.somedomain.com/dir/page.html from frame with URL http://bar.somedomain.com/otherdir/otherpage.html. Domains, protocols and ports must match"

What exactly are the rules for these types of requests?

like image 907
Matt Avatar asked Oct 26 '10 15:10

Matt


2 Answers

In short, the rules of the same origin policy are:

  • same host
  • same port
  • same protocol

In your example you are violating the host rule, as a different subdomain could point to a different host/ IP than another, even if the second level domain is the same.

If you have no other possibility, you could try to use JSONP in your ajax request; this doesn't have an SOP.

Reference

like image 82
codeporn Avatar answered Oct 16 '22 11:10

codeporn


No cross sub domain requests are not allowed in any browser. But there are some ways like CORS, using iframes, setting document.domain to make it work (although with some limitations).

like image 5
Teja Kantamneni Avatar answered Oct 16 '22 11:10

Teja Kantamneni