views:

37

answers:

3

Ok so my question title may have been a little confusing.

Here's my example:

www.WebsiteA.com is hosting MyFile.js at http://www.WebsiteA.com/MyFile.js. This file makes an AJAX request for http://www.WebsiteA.com/location/file

When this Javascript file is included on WebsiteB through the script tag, will the Javascript run into cross-domain issues or is it based upon where the actual Javascript file is hosted?

Hopefully you understand me ok, thanks for any responses :)

Mike

+2  A: 

The same origin policy applies to the domain of the site (ie. the URL you see in your browser's address bar). The JavaScript file can be hosted on any domain. The <script> tag is exempt from the same origin policy.

If the address bar in the browser is showing www.websiteB.com, you will bump into the same origin policy if you make a request to a file on www.websiteA.com. This is irrelevant of where the .js file is hosted. If this is the case, you may want to check out the following Stack Overflow post for a few workarounds:

Daniel Vassallo
A: 

You can do this - this is how most javascript based analytics trackers work (Google Analytics etc)

Michael Shimmins
You download the file from Google, so it can go back to Google. If you download from one site, that javascript file can't go to another site, though you can change the browser location and the browser can go.
James Black
I know - he was asking about that. If site A hosts a JS file that makes an AJAX call to a resource hosted on site A, if site B references that JS will the AJAX call in the script still work. Thats what GA does. You include the script from google, and it makes a call to another resource on the same domain that hosts the script you're including.
Michael Shimmins
At first I thought you were right Michael, but looking at it now doesn't Google Analytics request an "image" which it is actually sending relative data to? Since it doesn't need to load up any data..
Mike Hayes
You know I think you're right. I've just checked out another one, and it doesn't make an AJAX request either, but rather adds a `<script>` tag to the `<head>` block with a PHP page as the `src` element. This gets hit and does the tracking, so its not AJAX at all.
Michael Shimmins
A: 

It depends on if you're using a relative path or a full path.

  • If it's relative, the hosting server will look relative to the URL that is being called
  • If it's full, you can specify any domain/host
vol7ron