How I learned to stop worrying and love the Same Origin Policy (SOP)

2 (JavaScript) execution contexts cannot access the DOM of one another, unless they are coming from the Same Origin

http://www.example.com/dir/index.html

leaving an empty domain value

SOP will not allow it

later CORS POST-Messages

iFrame Relay / iFrame Proxy Fragment ID message encoding

JSONP

Domain Relaxation

Server Proxy

between frames

client to server

earlier

iframe

iframe message



Domain relaxation = expressing trust in shared sub-domains

 Pros: 

Works, standard behavior

 Cons:  

Requires servers to reside in the same domain – a limitation Not super-secured

 Note: Domain relaxation doesn’t affect XmlHttpRequest object

later CORS POST-Messages

iFrame Relay / iFrame Proxy Fragment ID message encoding

JSONP

Domain Relaxation

Server Proxy

between frames

client to server

earlier

1: load

Domain A

2: send message

Domain B

iframe - domain B

document – origin A 2: post message

4: post message (/w response)

1: load proxy.js 1.1: register proxy.js 3: ajax call

Domain B

it's a bit complicated