2 ms·
I have never heard of this. Can you share a link that goes into detail about this behavior? I don't immediately see anything on MDN's same-origin page talking a
by woogley 8y ago
I have never heard of this. Can you share a link that goes into detail about this behavior? I don't immediately see anything on MDN's same-origin page talking about it
- benmmurphy 8y agoI'm 99% sure this is not a thing and if it was it would be incredibly broken and not secure and most non-trivial pages relying on it for security would be vulnerable to the third party script. Anyway. This can easily be proved one way or another. `Here is an example that shows a third party script accessing a first party domain. There is no CORs as far as I can see: https://jsfiddle.net/aopmtn46/ https://jsfiddle.net/aopmtn46/ If you open the console you will see "STATUS 404" which is not possible if same origin on third party scripts is enforced.
- woogley 8y agothank you for this test!