I was looking at cross-domain requests for a design and stumbled upon something that puzzles me. From a local site I’m firing an Ajax request to another domain (with jQuery and vanilla XMLHttpRequest). Sure, the request fails and I can only get a fail event, which seems perfectly normal du to same-origin policy. But I noticed in Fiddler that the request is actually made and succeeds! It’s seems that it’s just that I can’t process the response.
Am I missing something, or is that a security hole? Sure, you can’t access data, but what’s the point of allowing sending data and just preventing response access?
The browser is making a request just in case there’s a CORS (Cross-Origin Resource Sharing) header there. Look closely at the http verb — probably it’s making an OPTIONS call to the remote server first.
If there is a CORS header, it’s checking to see if the CORS header requires filtering out headers, or methods, or parts of the response.
If there’s no CORS header, then it just throws the response on the floor and returns an incomprehensible error. Go browser!
The same-origin policy is a security feature strictly for the client side. Do search on CORS and you can get more information about what it entails.
BTW if you’re implementing any authorization scheme at all, like OAuth, then the same-origin policy is pretty much redundant, and your service can safely use CORS to defeat it. Same if the service serves up “unprotected” or “public” information that you don’t care if it gets out — or you actively want it to be accessible.