Cross-Origin XMLHttpRequest - Google Chrome

Cross-Origin XMLHttpRequest - Google Chrome

Regular web pages can use the XMLHttpRequest object to send and receive data from remote servers, but they're limited by the same origin policy. Extensions aren't so limited. An extension can talk to remote servers outside of its origin, as long as it first requests cross-origin permissions.

Extension origin#

Each running extension exists within its own separate security origin. Without requesting additional privileges, the extension can use XMLHttpRequest to get resources within its installation. For example, if an extension contains a JSON configuration file called config.json, in a config_resources folder, the extension can retrieve the file's contents like this:

var xhr = new XMLHttpRequest();  xhr.onreadystatechange = handleStateChange; // Implemented elsewhere.  xhr.open("GET", chrome.extension.getURL('/config_resources/config.json'), true);  xhr.send();

If the extension attempts to use a security origin other than itself, say http://www.google.com, the browser disallows it unless the extension has requested the appropriate cross-origin permissions.

Read full article from Cross-Origin XMLHttpRequest - Google Chrome