Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Which browsers allow cross domain ajax calls with Access-Control-Allow-Origin: *?

Tags:

Which browsers allow cross domain ajax calls with Access-Control-Allow-Origin: *? I am setting a REST service and trying to decide if I need to support JSONP to allow cross domain javascript access or if it is good enough to set the Access-Control-Allow-Origin header.

like image 882
Chad DeShon Avatar asked Dec 09 '10 22:12

Chad DeShon


People also ask

How do I enable cross-origin request in Ajax?

By default you are not allowed to make AJAX requests to another domain. Your browser applies the Same-origin policy as part of the web security model. To allow the browser to make a cross domain request from foo.app.moxio.com to sso.moxio.com we must set up a CORS policy on the target domain.

How do I enable cross-origin in browser?

To enable cross-origin access go to Tools->Internet Options->Security tab, click on “Custom Level” button. Find the Miscellaneous -> Access data sources across domains setting and select “Enable” option.

What is cross-origin Ajax?

CORS is a mechanism that defines a procedure in which the browser and the web server interact to determine whether to allow a web page to access a resource from different origin. Figure 2. Cross domain ajax request. When you do a cross-origin request, the browser sends Origin header with the current domain value.

Does Ajax support cross domain?

Browser does not allow cross domain AJAX requests due to security issues. Cross-domain requests are allowed only if the server specifies same origin security policy. To enable CORS, You need to specify below HTTP headers in the server.


1 Answers

Here's one reference suggesting that support in modern browsers is reasonable (but see the note at the end of this answer), assuming client-side code handles the IE issue on purpose. (IE8 and IE9 support CORS, but not via XMLHttpRequest —you have to use XDomainRequest instead, and it's worth noting that neither jQuery nor Prototype does that for you in their ajax wrappers — I don't know about other libraries. IE10 finally gets it right.) That page says, in essence, that CORS is supported in the desktop versions of:

  • IE8+ (via XDomainRequest), IE10+ (properly)
  • Firefox 3.6+
  • Safari 4.0+
  • Chrome 6+
  • Opera 12.1+

...as well as

  • iOS Safari 3.2+
  • Android browser 2.1+

You have to ask yourself what your target market is and whether they're likely to still be using older versions of IE, because it matters quite a lot who you're targeting. But overall, you still (for the moment) probably want to look at a JSONP interface — even in the U.S. mostly-home market, IE6+IE7 = about 20% of the users. I don't know many sites that can just ignore a fifth of the market. :-) And if you look at corporate users, or users in Asia or Africa or Central America, that number goes up markedly. The foregoing was true in 2010. Here in 2013, China is really the only holdout using IE6 (>24% there). Worldwide, IE6 and IE7 users have moved on to IE8 and IE9, and even big corporate and government users have finally "got it" about the security risks. IE8 will be with us for a while (as that's has high as IE goes on Windows XP), but you can bet the nearly 20% using IE9 will be on IE10 soon.

like image 161
T.J. Crowder Avatar answered Sep 18 '22 18:09

T.J. Crowder