Search code examples
javascriptsame-origin-policy

JavaScript Same Origin Policy - How does it apply to different subdomains?

How does the Same Origin Policy apply to the following two domains?

http://server1.MyDomain.com

http://server2.MyDomain.com

Can I run JS on a page hosted on server1, if the content is retreived from server2?

edit according to Daniel's answer below, I can include scripts between different subdomains using the <script> tag, but what about asynchronous requests? What if I download a script from server2 onto the page hosted on server1. Can I use the script to communicate asynchronously with a service on server2?

Solution

  • You can only include scripts between different subdomains using the <script> tag, as it is exempt from the policy.

    Using http://www.example.com/dir/page.html as source (from Wikipedia):

    Compared URL                               Outcome  Reason
---------------------------------------------------------------------------------------------
http://www.example.com/dir/page.html       Success  Same protocol and host
http://www.example.com/dir2/other.html     Success  Same protocol and host
http://www.example.com:81/dir2/other.html  Failure  Same protocol and host but different port
https://www.example.com/dir2/other.html    Failure  Different protocol
http://en.example.com/dir2/other.html      Failure  Different host
http://example.com/dir2/other.html         Failure  Different host (exact match required)
http://v2.www.example.com/dir2/other.html  Failure  Different host (exact match required)

    UPDATE:

    Can I use the script to communicate asynchronously with a service on server2?

    Yes, you can with JSONP, which takes advantage of the open policy for <script> tags to retrieve JSON from other origins.

    You may also want to consider using a reverse proxy, as desribed in the following Stack Overflow post: