I have a website www.foo.com:8002 that I have resolve to 127.0.0.1:8002 in my hosts file. I have another (the main site) running at localhost:80
In www.foo.com:8002 the page looks like
<form name="myform" action="http://localhost/bar" method="post"> <input type="hidden" name="some" value="value" /> </form> <script> document.myform.submit() </script>
I expected for the request to go through and the browser (Chrome) to not read the response since it violates the same origin policy. However, it turns out that the browser receives the response and displays the contents perfectly fine. How is this possible?