Why are AJAX requests limited to same domain?

Question

Something I find really confusing, is why are ajax requests limited to the same domain? What is the reasoning behind this?

I don't see any problem with requesting files from external locations, also servers making XMLHTTP requests seem to get and post to external locations fine.

Answer 1

Here is some information to satisfy your question: http://en.wikipedia.org/wiki/Same_origin_policy

Answer 2

It's for security purposes - if a website could execute AJAX calls to any domain they wanted on the client side, it poses a serious risk.

There are ways around this though - you could have your AJAX call a PHP script on the same domain, which in turn can call a script from another domain and return it. This wouldn't be using the browser as the communication medium though, it'd be using your web server.

Answer 3

Picture this :

You come on my fabulous website www.halfnakedgirls.com. You have fun watching what looks like technical documentation on human physiology, but behind your back, some lines of javascript are executing some request another domain, let's say www.yourpaypallike.com.

Requests like http://www.yourpaypallike.com/account/[email protected]&amount=984654 or http://www.mymailprovider.com/mails/export?format=csv.

Do you know see why it is forbidden ? =)

Answer 4

Tom, It is not "Ajax request limited".. Ajax is based on Javascript. For security reason javascript is prohibited access on cross domains. If you really want to do cross domain Ajax, you can do a hack.

YourPage(Ajax) ----> YourServer ----> ExternalDomain

You can call a page in yourserver usin Ajax, Your domain will call to external domain using server side , and get the result then return to you as Ajax response.