6

I know there are very many cross-domain questions but I haven't been able to find what I'm looking for.

I'd like to make an client AJAX request from a.com to b.com, which obviously isn't allowed. I thought that if I created a b.a.com -> b.com CNAME record then the browser would allow this request, since it means whoever owns the a.com domain wants to explicitly allow requests to b.com, but I still get a Access-Control-Allow-Origin error that doesn't allow the request. Is it not possible to make this request happen with CNAMEs?

Note: I have no control over b.com, so I can't set headers there.

2 Answers2

10

No. (But I have a real explaination)

The "rules of the road" for "cross-domain requests" are generally governed by the "Same Origin Policy" (see: The W3C Commentary, Wikipedia, Google Browser Security Handbook, Mozilla Developer Network)

The W3C specifically states that:

An origin is defined by the scheme, host, and port of a URL.

According to this definition, even requests from foo.com to bar.foo.com would be blocked.

In your example, you suggest that creating a CNAME for bar.foo.com which points at bar.com (I'm assuming you had a typo) should allow requests to bar.com via bar.foo.com. But, as I stated above, even requests originating from foo.com would be blocked on the client side from making HTTP requests to bar.foo.com.

Mozilla's page even has this specific example:

Mozilla considers two pages to have the same origin if the protocol, port (if one is specified), and host are the same for both pages. The following table gives examples of origin comparisons to the URL http://store.company.com/dir/page.html:

URL | Outcome | Reason

http://store.company.com/dir2/other.html | Success
http://store.company.com/dir/inner/another.html | Success
https://store.company.com/secure.html | Failure | Different protocol http://store.company.com:81/dir/etc.html | Failure | Different port http://news.company.com/dir/other.html | Failure | Different host

Steve
  • 29,538
  • 18
  • 94
  • 121
1

No.

I have never heard of CNAME as a way of getting around this problem, so I think it is safe to assume it is not a solution to your problem.

Muhd
  • 20,699
  • 20
  • 59
  • 72