3 ms·
The lack of background scheduled tasks in iOS is turning into same origin policies for JS in web browsers. Everyone gets around it with ridiculous hacks (JSONP)
by pkulak 14y ago
The lack of background scheduled tasks in iOS is turning into same origin policies for JS in web browsers. Everyone gets around it with ridiculous hacks (JSONP) to the point where the restriction is meaningless and it just causes more work for devs and problems for consumers.
It is neat that people are finding these loopholes, though. Any Downcast devs reading this? Hint hint hint...
- ricardobeat 14y agoDespite the hacks (unnecessary since cross-domain xhr), the security benefits of same-origin remain.
- simonw 14y agoI couldn't agree more. Same-origin is one of the most important components of browser security. JSON-P doesn't mean that same-origin is a waste of time just because there's a work-around - it demonstrates that sites should be allowed to opt-out of same-origin protection if they have a reason to, leading to the development of CORS. Without same-origin protection, I could run JavaScript on any website which silently used XMLHttpRequest to steal information from a web server running on your company's internal intranet. All I'd have to do then is trick you in to visiting my site.