0

I'm a little bit confused:

if I make:

$.get('http://externhost/somefile.js', callback, 'text');

I got:

XMLHttpRequest cannot load http://externhost/somefile.js. Origin http://www.myhost.at is not allowed by Access-Control-Allow-Origin.

but if I make the following request, I have no problem and everything happens correctly:

$.get('http://externhost/somefile.js', callback, 'script');

I don't know why this works with datatype script, but not with text/html/json.

Ian Clark
  • 9,237
  • 4
  • 32
  • 49
tiefenb
  • 732
  • 3
  • 16
  • 32
  • What are you actually trying to do? What content are you trying to load? Have a look at this: http://stackoverflow.com/questions/3506208/jquery-ajax-cross-domain – Ian Clark Jul 22 '13 at 09:34
  • It's a security mesure. It doesn't allow you to get scripts on another host. Yet I have no idea why you can do it when you set the datatype to script. – Romain Braun Jul 22 '13 at 09:34
  • datatype script creates an – tiefenb Jul 22 '13 at 11:27

1 Answers1

1

It looks like you're trying to load a script from an external resource. This can be potentially dangerous, so you're prevented from loading external resources for reasons such as the one provided here:

Imagine that you are checking some stuff on your ebay account. Then in another tab you open my site, where I have a script that makes a series of requests to ebay (you are still logged in) and bids you for an Audi A8 without you even noticing. Annoying... If it was your bank it can directly steal money from you.

I won't attempt to explain why you're script is failing to load, other than noting the obvious: you're trying to load a JavaScript file as plain text. jQuery is probably subverting the restrictions silently by adding a script element into your document with the given src attribute. Looking at my document when I did the same thing (using prototype.js loaded from Google code) this is what happened.

The bottom line here is, what are you trying to do? If you're trying to load a JavaScript document, use the .getScript() method. That will essentially create a new script element with the given source and load in the external document. If you're trying to use JSON, then use the .getJSON() method instead, but note that this is where you'll have to get around the cross-site scripting barriers, either by using JSONP (see the getJSON() docs, and here), or by setting the appropriate HTTP Access Controls (CORS), provided you own the server, like so:

Access-Control-Allow-Origin: http://yoursite.com
Community
  • 1
  • 1
Ian Clark
  • 9,237
  • 4
  • 32
  • 49