understanding JavaScript security model

Question

Why is it that I can submit a form to an iframe with a cross-domain address but can't send an XMLHTTPRequest to that address?

bhamlin · Accepted Answer · 2012-10-25 01:38:46Z

4

For the very simple reason that your code doesn't get to see the result of the iframe post. Your script will be denied access to the iframe's DOM.

And keep in mind this is really the browser's security model, not JavaScript's.

answered Oct 25, 2012 at 1:38

bhamlin

5,1971 gold badge24 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

MK. Over a year ago

Well, yeah, but wouldn't it make sense to allow XMLHTTPRequest but deny access to the response?

bhamlin Over a year ago

There's no scenario where allowing the XmlHttpRequest would make sense - failing early is better than failing late. Posting to an iframe, however, has plenty of real scenarios (like actually showing the iframe). If you need to make a request and you don't care about the result, consider a hidden image tag.

Collectives™ on Stack Overflow

understanding JavaScript security model

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related