How does Google's javascript API get around the cross-domain security in AJAX

Question

How does Google's API make cross-domain requests back to Google, when it's on your website?

Answer 1

AFAIK they use IFRAMEs.

Answer 2

<script> tags work cross-domain. See also: JSONP

Answer 3

They get around it by dynamically injecting script tags into the head of the document. The javascript that is sent down via this injection has a callback function in it that tells the script running in the page that it has loaded and the payload (data).

The script can then remove the dynamically injected script tag and continue.

Answer 4

Another possibility is to use the window.name transport as described for the dojo framework here