what prevents sending "$.post" from one domain to another?

Question

I have one website in chromium tab, and an other website in another tab, Im executing single post command in the second website - $.post(...); to the first website. Originaly its not working (getting: "No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘null’ is therefore not allowed access") ,but if runing chromium with "--disable-web-security --user-data-dir=~/.chrome-tmp " flags it will send the post. the question is, what exactly changed so after putting those flags the post is sent ? I first thought that it disabled "same origin policy" but after some reading it seems like it has nothing to do with it.

Answer 1

The --disable-web-security flag will prevent Chromium from enforcing the same-origin policy (SOP), which will allow you to read the response of your cross-origin POST request.

However, do note that the POST request is always sent, regardless of same-origin policy. Anything that takes place on the server for that request will still happen (creating a resource, updating something, etc.) This is what is meant by cross-domain writes are allowed:

The simplest explanation of SOP is that Origin “A” has the following permissions:

• Read of resources from Origin “B”: Deny
• Write to Origin “B”: Limit
• Execute of resources from Origin “B”: Allow

Source: https://blogs.msdn.microsoft.com/ieinternals/2009/08/28/same-origin-policy-part-1-no-peeking/

More explanation about "limited write" can be found on part 2 of that blog post.

Mozilla's documentation also explains it well, using different terminology. (jQuery's $.post uses XMLHttpRequest)

The same-origin policy controls interactions between two different origins, such as when you use XMLHttpRequest or an <img> element. These interactions are typically placed in three categories:

• Cross-origin writes are typically allowed. Examples are links, redirects and form submissions. Certain rarely used HTTP requests require preflight.
• Cross-origin embedding is typically allowed. Examples are listed below.
• Cross-origin reads are typically not allowed, but read access is often leaked by embedding. For example you can read the width and height of an embedded image, the actions of an embedded script, or the availability of an embedded resource.

Source: https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#Cross-origin_network_access