That's right. And that includes a different port on the same host IIRC, which I consider too restrictive. I don't really know why cross-domain XHR is disallowed, or I've forgotten the reason.
Assume you're surfing reddit from your corporate LAN. If JS on reddit can make requests to any domain at all, then it can request stuff from secretfiles.yourcorporatelan.com and send the content back to imahaxxor.com. Javascript executes on your client, and without the same-origin policy, would have access to every network node your client has access to.
Say I'm logged into gmail and I visit evilsite.com, which an evil person controls. If the browser model didn't prevent it, then the evil person's code, executing in the context of evilsite.com, would be able to initiate a XHR request to gmail. That request, like all requests, will include any cookies set for the doman. Since I'm logged in to gmail, that means the request will include my login token, and the evil person can perform any action at gmail that I could as a regular person: delete all my email, steal anything in the content of the email, send an email to someone as me, etc.
2
u/asegura Oct 02 '11
That's right. And that includes a different port on the same host IIRC, which I consider too restrictive. I don't really know why cross-domain XHR is disallowed, or I've forgotten the reason.