Access-control-allow-origin and cross-domain

Access-control-allow-origin and cross-domaintime 2014-03-27 20:24:31 freewind.me original http://freewind.me/blog/20140327/2456.html

Today with Meng Meng Fix bug, encounter a cross-domain problem. All two of us are not very clear about it, and make a note of it together.

Problem

A cross-domain issue occurs when you use AJAX to request data from a page under another domain name. Another domain name must be added to Access-Control-Allow-Origin the response header in order for the former to get the data successfully.

Is that the right thing to say? If yes, then what is the process?

Cross-domain

How to calculate cross-domain? Protocols, domain names, and ports must all be the same before they are counted in the same domain.

Reference:

• is different ports on the same server considered Cross-domain? (ajax-wise)
• Colleague Li Dong's blog: Cross-origin resource sharing

When cross-domain access, will the browser send a request?

This is the problem that really bothers us because we don't know what the browser will do. Will it check that the address you want to request is not the same domain, and it is banned directly?

I did an experiment on Jsbin and opened it with Chrome. When you click "Run with Js", the console will be typed:

load http://google.com/. No ‘Access-Control-Allow-Origin‘ header is present on the requested resource. Origin ‘http://run.jsbin.io‘ is therefore not allowed access. 

But the "Network" Bar of the developer tool does not have any records. Did it actually send a request?

I used to python -m SimpleHTTPServer create a small server locally, and then change the address to it, and found that on the Python side does print a request, the browser does make a request.

Access-control-allow-origin

Now it's time to play Access-Control-Allow-Origin . The browser allows us to take the data from its page to the next step only if the header is included in the response of the target page, Access-Control-Allow-Origin and its value has our own domain name. Such as:

Access-Control-Allow-Origin: http://run.jsbin.io

If its value is set to * , it means anyone can use:

Access-Control-Allow-Origin: *

Yes, in the product environment, no one will use*

You can read the following article to learn more, and find the "Run Sample" link to actually experience:

http://www.html5rocks.com/en/tutorials/cors/

Access-control-allow-origin and cross-domain