The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

This restriction on the data that individual scripts can access is part of

a more general 

same origin policy

implemented by all modern browsers. This

policy is designed to place barriers between different web sites that are being

accessed by the browser, to prevent them from interfering with each other. The

main features of the policy that you need to be aware of are:

■■

A page residing on one domain can cause an arbitrary request to be

made to another domain (for example, by submitting a form or loading

an image), but it cannot itself process the data returned from that

request.

■■

A page residing on one domain can load a script from another domain

and execute this within its own context. This is because scripts are