What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?
I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...
The answer to this question about how cookies are potentially vulnerable between sub-domains sparked my curiosity. As far as I know, if a cookie is set on a sub-path of the same domain ...