javascript - 为什么HTML SCRIPT标签不受同源策略约束

Question

我问这个问题是因为我们将开发一个应该通过 JavaScript 共享跨源数据的应用程序。一种可能的解决方案是 JSONP，因为它使用 SCRIPT 标签从其他域提取数据。然而，我想避免这样的情况:我们在假设 SCRIPT 标记不受 sop 约束的情况下实现了很棒的代码，并且在某些时候浏览器禁止此功能。

有人可以解释一下 SCRIPT 标记允许跨域请求的原因吗？

Answer 1

我想this draft标题为“同源策略的原则”的文章解释了(尽管很简短)每个人的想法:

In principle, user agents could treat every URL as a separate principal and isolate each document from every other URL unless the document explicitly indicated that it trusted that URL. Unfortunately, this design is cumbersome for developers because web applications often consist of a number of resource acting in concert.

As an approximation, user agents group URLs together into protection domains called origins. In particular, two URLs are part of the same origin (i.e., represent the same principal) if they have the same scheme, host, and port.

简而言之:如果一切都遵循 SOP，那么构建 Web 就会困难得多。