I thought cross-subdomain AJAX requests were allowed, but this Chrome error seems to indicate otherwise

Question

I know that cross-domain requests are disallowed for security reasons, but I was under the impression that only the top-level domain needed to match, that different sub-domains were okay. However, I am getting this error from Chrome 7: "Unsafe JavaScript attempt to access frame with URL http://foo.somedomain.com/dir/page.html from frame with URL http://bar.somedomain.com/otherdir/otherpage.html. Domains, protocols and ports must match" What exactly are the rules for these types of requests?

Accepted Answer

In short, the rules of the same origin policy are:

- same host

- same port

- same protocol

In your example you are violating the host rule, as a different subdomain could point to a different host/ IP than another, even if the second level domain is the same.

If you have no other possibility, you could try to use JSONP in your ajax request; this doesn't have an SOP.

Reference

I thought cross-subdomain AJAX requests were allowed, but this Chrome error seems to indicate otherwise

Solution

Problem