Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is google AJAX Libraries API bypassing same origin policy?

From: https://developer.mozilla.org/En/Same_origin_policy_for_JavaScript

The same origin policy prevents a document or script loaded from one  
origin from getting or setting properties of a document from another origin.
This policy dates all the way back to Netscape Navigator 2.0.

So why is not the same origin policy enforced?, when a have a script tag like this:

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>

I'm sure I'm missing 'something', I've read
http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy
a bunch of times but can not figure out...

like image 650
Cesar Avatar asked Jul 23 '09 11:07

Cesar


2 Answers

HTML can load from wherever it likes, it's another script running on the page that can't fetch documents from another origin.

like image 91
Sam Hasler Avatar answered Oct 26 '22 23:10

Sam Hasler


<script> tags are an exception to this rule. A page is allowed to "invite" a script from another server, and that's considered OK.

(The whole economy of the internet - on-page advertising - is based on this being allowed! Although it does represent a security risk, it's not going to change any time soon.)

like image 20
RichieHindle Avatar answered Oct 27 '22 00:10

RichieHindle