Cross-domain access and same-origin policy

Because it is possible to open multiple Web pages in the same browser window at the same time, and they are all in the same session, if cross-domain access is not prohibited, there is a problem of user privacy data disclosure and logon identity spoofing, so the browser uses the same-origin policy to restrict cross-domain access.

In the browser, access to URLs or iframe under different domain names via JS code is forbidden. Instead of cross-domain access via JS code, there are no cross-domain issues! For example, cross-domain loading of images, referencing JS files, downloading various files, using the IFRAME cross-domain embedded in other sites of the page is possible.

Cross-domain access bans can sometimes hinder application development, but there are also ways to address cross-domain access issues when certain conditions are met:

1 Add Access-control-allow-origin to the response header of the other server which domains are allowed to cross-domain access, which can be either a domain name or *. (this scheme can only be used if the other party trusts, doesn't care, and is safe.) ）

2 If the domain name is a subdomain of the same root domain name, you can use document.domain= "root domain Name" to unify the domain name of JS execution environment. (this scheme can only be used within the same company and organization)

3 Use JSONP (JSON Padding). The browser does not restrict the script to introduce other websites via the script tag, so we can add a script tag to the page dynamically by JS and specify its src as a special URL, and the other's server requests for this URL will be handled specially.

4 The URL that will be requested to send to its own server, let the server initiated the request (the server has no cross-domain restrictions), the server after the successful request, the data will be transmitted to the browser JS (this way is called the service-side proxy request, this way as long as their service side support is OK, is a more common scenario, without any restrictions).

5 Exchange data across domains using any browser-side intermediate mechanism that can be leveraged.

Cross-domain access and same-origin policy