Summary
In this post I tried to illustrate what type of requests are classified as Cross-Origin and why they are blocked by browsers under the Same-Origin-Policy. Furthermore, I discussed several mechanisms to perform Cross-Origin requests. The table below summarizes these mechanisms.
| Mechanism | Supported HTTP verbs | Server-side modifications required? | Remarks |
|---|---|---|---|
| JSONP | GET | Yes (return script block containing function call instead of raw JSON) | Requires absolute trust in the server |
| Proxy | ALL | No (but you need an extra proxy component in your origin) | Back-end performs the request instead of the browser. Could prove problematic for authentication |
| CORS | ALL | Yes (return additional HTTP headers) | Not supported on older versions of Internet Explorer. For “complex” requests, needs to make an extra HTTP call (preflighted requests) |
Read full article from Cross-Domain requests in Javascript | jvaneyck
No comments:
Post a Comment