Same-origin policy for JavaScript (Ajax) and cookies

A URL consists of four parts. For example, www.2cto.com (the default port of http is 80, and the default port of https is 443. This URL is equivalent to www.2cto.com: 80 protocol: http Host: www.2cto.com port: 80 path:/so-called same source... SyntaxHi

A URL consists of four parts. For example, www.2cto.com (the default port of http is 80, and the default port of https is 443. If it is the default port, it can be omitted, so this URL is equivalent to www.2cto.com: 80

Protocol: http

HOST: www.2cto.com

Port: 80

Path :/

The so-called same source is the protocol that requires this URL. The host and port are all the same. Generally, the domain or domain is also the source concept here.

The preceding URL has the following results:

 

Other URLs	Same source?	Cause
Http://blog.csdn.net/xilang/index.html	Yes
Http://blog.csdn.net/yanical/othersub	Yes
Https://blog.csdn.net/yanical	No	Different protocols and ports
Http://blog.csdn.net: 81/yanical.	No	Different ports
Http://www.csdn.net/	No	Different Hosts

 

There is an exception. javascript can modify the host and port values by setting document. domain. If this is done, the set value will be used as the standard for the same-source policy check. For example, for http://blog.csdn.net/yanicaland http://bbs.csdn.net/, you can execute the following javascript:

[Javascript] document. domain = "csdn.net ";
 

In this way, the two pages are the same source. For security reasons, it cannot be set to another primary domain, such as http://www.csdn.net/or Sina.com.

We can see that only the host part is set in javascript, and the port part is not mentioned. In fact, when executing the javascript above, the port is also set and set to null. So for http://blog.csdn.net: 81/yanical and retail.

The same-origin policy was first used to prevent a source js from getting or modifying the document attributes of another source. The javascript source here refers to the source of loading the HTML page of javascript, instead of the javascript source.

For example, there are two HTML and two javascript. .

Test.html:
 
[Html]