- Cross-Origin Resource Sharing
-
Cross-Origin Resource Sharing (CORS) is a web browser technology specification, which defines ways for a web server to allow its resources be accessed by a web page from a different domain.[1] Such access would otherwise be forbidden by the same origin policy.
Contents
Browser support
CORS is supported by all browsers based on the following layout engines:
- Gecko 1.9.1 (Firefox 3.5,[2] SeaMonkey 2.0[3]) and above
- WebKit (Initial revision uncertain, Safari 4 and above,[1] Google Chrome 3 and above... possibly earlier[4])
- MSHTML/Trident 4.0 (Internet Explorer 8) provides partial support via the XDomainRequest object.[1]
The following browsers are also noteworthy in their lack of CORS support:
- No Presto-based browser implements CORS as of Opera 11.5, Opera Mobile 11.1, and Opera Mini Mini 6.0.[5]
- Camino does not implement CORS in the 2.0.x release series as these versions are based on Gecko 1.9.0.[6]
- As of version 0.10.2, Arora exposes WebKit's CORS-related APIs, but attempted cross-origin requests will fail.[7]
History
Cross-origin support was originally proposed by Matt Oshry, Brad Porter, and Michael Bodell of Tellme Networks in March 2004 for inclusion in VoiceXML 2.1[8] to allow safe cross-origin data requests by VoiceXML browsers. The mechanism was deemed general in nature and not specific to VoiceXML and was subsequently separated into an implementation NOTE.[9] The WebApps Working Group of the W3C with participation from the major browser vendors began to formalize the NOTE into a W3C Working Draft on track toward formal W3C Recommendation status.
CORS relationship to JSONP
CORS can be used as a modern alternative to the JSONP pattern. While JSONP supports only the GET request method, CORS also supports other types of HTTP requests. Using CORS enables a web programmer to use regular XMLHttpRequest which supports better error handling than JSONP. On the other hand, JSONP works on legacy browsers which preclude CORS support. CORS is supported by most modern web browsers.[10]
References
- ^ a b c http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/
- ^ https://developer.mozilla.org/En/HTTP_access_control
- ^ https://developer.mozilla.org/en/Gecko
- ^ http://osvdb.org/59940
- ^ http://caniuse.com/cors
- ^ http://forums-test.mozillazine.org/viewtopic.php?f=12&t=1579855
- ^ http://code.google.com/p/arora/issues/detail?id=904
- ^ http://www.w3.org/TR/2004/WD-voicexml21-20040323/
- ^ http://www.w3.org/TR/2005/NOTE-access-control-20050613/
- ^ http://www.nczonline.net/blog/2010/05/25/cross-domain-ajax-with-cross-origin-resource-sharing/
External links
Categories:- Ajax (programming)
- World Wide Web Consortium standards
Wikimedia Foundation. 2010.
