同源策略 (SOP) 如何运作？
我在维基百科上读到过同源政策的含义，但无法理解它是如何工作的。我确实明白，它会阻止我网站上的 JavaScript 与单独网站上的脚本进行交互，但这到底意味着什么？
I had a read of what same origin policy means on Wikipedia however fail to understand how it works. I do understand that it prevents for example a javascript on my website from interacting with a script on a separate site however what does this exactly mean?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您的脚本 (JS) 尝试向站点执行某些 HTTP 请求，而不是通过 XMLHttpRequest 发起的请求，则该请求将失败，返回状态代码将为 0 且错误消息为 null。
这就是它最初的工作原理。
现在有一个跨源资源共享（CORS）规范，大多数现代浏览器或多或少都支持该规范。它允许执行此类请求，但有严格的限制。
If your script (JS) tries to perform some HTTP request to the site other than the one it originated from via XMLHttpRequest, the request will fail, return status code will be 0 and error message - null.
That's how it worked originally.
Right now there is a Cross-Origin Resource Sharing (CORS) specification, which is more or less supported by most modern browsers. It allows to do such requests, but with strict limitations.
这意味着如果您加载
http://www.stackoverflow.com/
并且您的浏览器加载了 javascript，那么该 javascript 无法访问以下网址：不是来自该页面。有很多细节，比如你无法访问
https://www.stackoverflow.com，
但是ajax请求可以访问
< a href="http://www.stackoverflow.com/something/something">http://www.stackoverflow.com/something/something
浏览器本身不允许触发请求。
编辑 - 这可能有帮助：http:// /www.google.com/support/forum/p/Chrome/thread?tid=171316324d16747b&hl=zh-CN
it means if you load
http://www.stackoverflow.com/
and your browser loads javascript, then that javascript cannot access a url that doesn't come from that page. There are a lot of details, for example, you could not access
https://www.stackoverflow.com
but an ajax request could access
http://www.stackoverflow.com/something/something
The browser itself would not allow the request to be fired.
EDIT -- This might be helfpul: http://www.google.com/support/forum/p/Chrome/thread?tid=171316324d16747b&hl=en