19

I know that cross-domain requests are disallowed for security reasons, but I was under the impression that only the top-level domain needed to match, that different sub-domains were okay. However, I am getting this error from Chrome 7:

"Unsafe JavaScript attempt to access frame with URL http://foo.somedomain.com/dir/page.html from frame with URL http://bar.somedomain.com/otherdir/otherpage.html. Domains, protocols and ports must match"

What exactly are the rules for these types of requests?

Matt
  • 41,216
  • 30
  • 109
  • 147
  • 3
    I wasn't pointing my finger to chrome, I was just pointing out that it was chrome who was giving me this informative answer that actually questioned my understanding of the rules :) – Matt Oct 26 '10 at 15:20

2 Answers2

27

In short, the rules of the same origin policy are:

  • same host
  • same port
  • same protocol

In your example you are violating the host rule, as a different subdomain could point to a different host/ IP than another, even if the second level domain is the same.

If you have no other possibility, you could try to use JSONP in your ajax request; this doesn't have an SOP.

Reference

codeporn
  • 1,000
  • 1
  • 13
  • 32
5

No cross sub domain requests are not allowed in any browser. But there are some ways like CORS, using iframes, setting document.domain to make it work (although with some limitations).

Teja Kantamneni
  • 17,402
  • 12
  • 56
  • 86