javascript - 关于 XMLHttpRequest 的同源限制

Question

我认为对于 XMLHttpRequest 的同源限制有些我不理解的地方。

与其禁止 Javascript 代码向不同的主机发送 http 请求(这对于合法用途来说确实很烦人)，不如在这种情况下只允许请求但不发送或接受 cookie？

在我看来，乍一看，禁止特定脚本获取互联网上其他所有人都能获取的内容似乎是一个非常奇怪的选择...

我错过了什么？

Answer 1

Instead of forbidding Javascript code to send http request to different hosts (something that is really annoying for legitimate uses) wouldn't have been better to just allow the request but not sending or accepting cookies in that case?

这就是Cross-Origin Resource Sharing (CORS)指定。

Care must always be taken by applications when making cross-origin requests with user credentials, and servers processing such requests must take care in the use of credentials, including the Origin header.

1. When requests have significance other than retrieval, and when relying on the Origin header as a credential, servers must be careful to distinguish between authorizing a request and authorizing access to the representation of that resource in the response.

...

omit credentials flag

Set when user credentials are to be excluded in the request and when cookies are to be ignored in its response.

---

Forbidding a specific script to get something that literally everyone else in the internet can get seems to me at a first sight a quite weird choice...

What am I missing?

网络标准机构花了一段时间才意识到人们想要编写严肃的 JavaScript 重应用程序。 Gmail 改变了这一切，但 W3C 等标准机构需要一段时间才能填补功能漏洞。