Search code examples
javascriptajaxsecuritysame-origin-policy

Same origin policy causes Ajax requests to example.com from www.example.com to be denied?


If you visit a website at http://www.example.com/dir , then any ajax requests to http://example.com/dir/something.php (with the www missing) cause the following message to show up in google chrome's console:

XMLHttpRequest cannot load http://example.com/dir/something.php.
Origin http://www.example.com is not allowed by Access-Control-Allow-Origin.

What's up with this, and what can be done to fix this?

Edit: It seems that any cookies set by example.com also disappear when you visit www.example.com ?


Solution

  • www.example.com and example.com are different domains and they can serve different content. www.stackoverflow.com only redirects to stackoverflow.com but technically it can display a site full of ponies instead.

    See Origin determination rules - it actually uses the exact same example.com (nomen est omen!) as an example.