同源政策解决方案

Question

I see the security risks with cross domain ajax calls,
but I think the real problem are the cookies that the browsers
automatically send to the target cross domain.

So why can't browser just not send cookies in the case of cross domain js request instead of blocking that request altogether ?

I hope my question makes sense.

EDIT:

from: https://en.wikipedia.org/wiki/Same-origin_policy

While this is true, the JavaScript has no direct access to the banking session cookie, but it could still send and receive requests to the banking site with the banking site's session cookie, essentially acting as a normal user of the banking site. Regarding the sending of new transactions, even CSRF protections by the banking site have no effect, because the script can simply do the same as the user would do

So Suppose I'm logged on facebook and meanwhile visiting a mslicious site that use cross site requests to facebook to steal information about me, I mean the only reason it could do it is because a legitimate cookie is included in the requests by the browser, am I wrong ?

Answer 1

You have a confusion of ideas.

A cookie is simply a cached information that is stored on the client side. Simply put it is data that is managed by the browser and how particular browser does it is their doing. For example IE stores cookies in separate text files, Firefox uses a single file and Crome uses SQLite3 database.

I recommend you read: Why is the same origin policy important?

You can send cross domain Get requests and there are several ways. I have used a proxy that adds the required headers or just Jsonp. For example in .net latter requires you to add a json formatter that gets the json callback function.

If you have 2-way communication with the web page none of this is required. You can manage the state at server side and do server side "push" request at your will. Before html5, you needed components to do that ex: java applet, flash, silverlight or ....

I hope my answer makes sense to you.