Search code examples
javascriptajaxcorsjsonpsame-origin-policy

Can external JavaScript files access their host origin without JSONP?

If I load a javascript file in my head HTML page which is not hosted in my server, like in this example:

<html><head>
<script src="https://code.jquery.com/jquery-1.11.2.min.js"></script></head>
<body>...

Is the script in this file authorized by the browser to make requests for the origial host (code.jquery.com) bypassing the same-origin-policy without the need to implement JSONP or CORS?

Solution

  • No...the request is made using the domain, port, protocol and subdomain the page is on.

    Where the scripts come from is irrelevant....they all get compiled into the current page (window)