I inadvertently wrote a cross-domain AJAX call to NextBus (with jQuery):
$.ajax({
url: 'http://webservices.nextbus.com/service/publicXMLFeed?command=predictions&a=sf-muni&r=1&s=6294',
dataType: 'xml',
success: function(data) {
do_stuff();
}
});
Thing is, it works on all browsers, despite coming from a different domain. Given the Single Origin Policy, why does this actually work?
The page is here: http://sftransitfirst.org/F/, selecting a stop from the pull-down triggers the ajax.
As expected, making a similar call to the Google Maps API Web Services fails with the familiar Origin ... is not allowed by Access-Control-Allow-Origin
(and it doesn't support jsonp).
Access-Control-Allow-Origin: *
. CORS