StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POWhy is cross domain AJAX prevented *if* you have no intention of evaluating the response as a script?
primarykey
Id
5692046
data
AcceptedAnswerId
0
AnswerCount
2
ClosedDate
CommentCount
2
CommunityOwnedDate
CreationDate
2011-04-17T06:49:56.737
FavoriteCount
0
LastActivityDate
2011-04-18T00:20:28.643
LastEditDate
2011-04-18T00:20:28.643
LastEditorUserId
286098
OwnerUserId
286098
ParentId
0
PostTypeId
1
Score
1
ViewCount
219
LastEditorDisplayName
text
Body
Let's say I want to use AJAX to retrieve a json file from an untrusted different domain. I then parse the response as a javascript object without any script evaluation. (A cookie is not sent with my request.) I don't understand why the browser prevents me from doing this. I understand that if I were to evaluate the response as a script then that would be a security issue. I understand that there are work-arounds to achieve the above. Is there a reason that my specific scenario should be prevented, or has it just got accidentally caught up in the same-origin dragnet? Thanks. (assuming the server does not support CORS)
Tags
<javascript><ajax><browser><cross-domain>
Title
Why is cross domain AJAX prevented *if* you have no intention of evaluating the response as a script?
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. USadam77
UserOwnerUserId
1. USadam77
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
2. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POWhy is cross domain AJAX prevented *if* you have no intention of evaluating the response as a script?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. COSo I came across this http://json.org/JSONRequest.html which is designed for precisely the use-case i describe. How come it has not garnered more support?
 singulars
 PostPostId
 POWhy is cross domain AJAX prevented *if* you have no intention of evaluating the response as a script?
 UserUserId
 USadam77
2. COFrom w3 http://www.w3.org/TR/access-control/: "JSONRequest has been considered by the Web Applications Working Group and the group has concluded that it does not meet the documented requirements. JSONRequest is a specific API and cannot handle e.g. cross-origin XSLT through <?xml-stylesheet?> or the same scenarios same-origin XMLHttpRequest can handle today in cross-origin fashion, e.g. manipulating resources making use of the REST architectural style." ???
 singulars
 PostPostId
 POWhy is cross domain AJAX prevented *if* you have no intention of evaluating the response as a script?
 UserUserId
 USadam77

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.