6

I inadvertently wrote a cross-domain AJAX call to NextBus (with jQuery):

$.ajax({
      url: 'http://webservices.nextbus.com/service/publicXMLFeed?command=predictions&a=sf-muni&r=1&s=6294',
      dataType: 'xml',
      success: function(data) {
           do_stuff();
      }
});

Thing is, it works on all browsers, despite coming from a different domain. Given the Single Origin Policy, why does this actually work?

The page is here: http://sftransitfirst.org/F/, selecting a stop from the pull-down triggers the ajax.

As expected, making a similar call to the Google Maps API Web Services fails with the familiar Origin ... is not allowed by Access-Control-Allow-Origin (and it doesn't support jsonp).

3
  • I think it's because the Google URL is "https"? Not sure tho Aug 28, 2012 at 15:34
  • 8
    The set of response headers from that URL contains Access-Control-Allow-Origin: *. CORS
    – Rob W
    Aug 28, 2012 at 15:35
  • 1
    @Rob Just write it as an answer;)
    – Christoph
    Aug 28, 2012 at 15:37

2 Answers 2

11

They must have explicitly allowed cross-domain access, with something of this manner:

<?php header('Access-Control-Allow-Origin: *'); ?>

Or with htaccess:

<ifModule mod_headers.c>
    Header set Access-Control-Allow-Origin: *
</ifModule>
3
  • I thought the SOP was a client-side (browser) security measure, though. Allowing the remote webservice to override the policy seems to defeat the purpose, doesn't it? i.e. that you shouldn't trust any old resource from another domain. Aug 28, 2012 at 15:42
  • @carillonator In the first place, SOP prevents scripts from different origins to access each others methods and properties thus e.g. preventing a third party script from reading the cookies your script has set.
    – Christoph
    Aug 28, 2012 at 15:48
  • 1
    @carillonator I can see where it would seem like a security risk. But this kind of setting will(should) only be enabled on sites that want there content accessible (eg, twitter). And from a security point of view the site you're viewing would also have to be making a call to that site which has allow-origin all allowed. So from a "hacker" worry point of view, access would already be needed to either insert the call to other site, or enable the access in the root, either of which the sites security has already been hugely compromised. Aug 28, 2012 at 15:55
5

Many modern web APIs enable Cross-Domain Resource Sharing (CORS). CORS is a method for websites to voluntarily make their pages available to cross-domain scripts. The Access-Control-Allow-Origin HTTP header from the server signals to your web browser that it is okay to allow the script to access the page with Ajax, even if the script is running on a different origin. If the server does not serve CORS headers, your browser will enforce the SOP as usual.

Most APIs choose to expose their pages to cross-domain scripts because they know that virtually all of their users will want to be able to access the API via Ajax from their own domains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.