Why Is The 'src' Attribute Allowed To Link To Scripts From External Domains, And Xmlhtpprequests Not?
I have read several answers on StackOverflow regarding same-origin policy, but I don't seem to graps the essential part. In all tags that use the src attribute, like
Solution 1:
The same-origin policy aims to protect the remote server's data from an unknown client, not to protect the client from malicious code from the server. <script>
tags do not allow the client to make requests other than GETs or to obtain data that is not explicitly exposed by the server in a valid JavaScript file.
Post a Comment for "Why Is The 'src' Attribute Allowed To Link To Scripts From External Domains, And Xmlhtpprequests Not?"