How does the browser / JavaScript same origin policy apply to two-level domain names?

Question

I have some JavaScript that is sharing a request between two separate servers on the same domain.

Is .com a requirement for the domain in JavaScript?

In this case both the servers are on the .abc.tyy domain with the tyy being what would normally be .com

Wondering if I can only use .com for the domain? I am getting a permission denied error, but this code works fine on other separate servers on the same domain(.com).

Updated: Here is exactly how I'm using this:

123.abc.tyy has a script that loads properties that I want to access.

The script on 123.abc.tyy at opening script tag, sets the document.domain to 'abc.tyy'.

When I call the 'getUser()' function in 123.abc.tyy's script FROM 234.abc.tyy I am getting a permission denied error.

The way I am calling 'getUser()' is: I access http://123.abc.tyy in a browser, and the site allows me to specify a URL to load in one of it's frames. I point that URL to http://234.abc.tyy/BeginLoadPatient.aspx" in that page I am doing the following:

window.location = 'http://234.abc.tyy/LoadPatient.aspx?PatientId=' + getUser() '; with getUser being a function originating in 123.abc.tyy

If I add 234.abc.tyy and 123.abc.tyy to my trusted sites, everything works fine - is this skipping over the same origin policy?

Answer 1

No, the SOP doesn't care what the domain is, only that it represents the same origin. (Could it be that you have the .com domain hard-coded somewhere?)

Note that there's more than the domain to consider. The Same Origin Policy looks at protocol, port, and host as well. So aaa.abc.tyy and bbb.abc.tyy are different origins.

If you're in control of the servers involved, you might look at Cross-Origin Resource Sharing, but unfortunately CORS is only implemented in modern browsers (and on those versions of IE where it's supported, it's only supported if you use it explicitly).

Another option, of course, is JSON-P, which has the advantage of working cross-browser right now.

Another thing to look at is document.domain, details here and here.

---

Update after your edits:

The script on 123.abc.tyy at opening script tag, sets the document.domain to 'abc.tyy'.

When I call the 'getUser()' function in 123.abc.tyy's script FROM 234.abc.tyy I am getting a permission denied error.

You'll need to set document.domain to "abc.tyy" in BeginLoadPatient.aspx as well.

If I add 234.abc.tyy and 123.abc.tyy to my trusted sites, everything works fine - is this skipping over the same origin policy?

I wouldn't be at all surprised (although to me it would be pretty dodgy), but have no first-hand knowledge of it. Would be easy to test.

Answer 2

I don't fully understand the scope of the question, but this may be useful to you.

http://stackoverflow.com/questions/2543784/javascript-same-origin-policy-how-does-it-apply-to-different-subdomains