CDN 或外部 JavaScript 文件如何在网站中运行？
首先，我很尴尬我不知道这一点。我知道这些东西有效，但只是不知道为什么。关于 CDN 以及 Google Analytics 或 Adsense 之类的东西，我仍然有一些不明白的地方。
如果这些脚本来自您网站域以外的域，这一切如何与同源策略结合起来（SOP）和跨站脚本 (XSS)？根据我对 XSS 和 SOP 的了解，这些脚本不应该能够在您的站点中运行或与 DOM 交互。他们怎么会被赋予特殊的特权呢？这些特殊权限与其他因 XSS 和 SOP 导致浏览器错误的外部脚本有何区别？
简而言之，我想知道为什么允许来自另一个域的脚本运行、交互和操作我的网站？
First off, I'm embarassed that I don't know this. I know these things work, but just not sure why. There is something I still don't get about CDNs and stuff like Google Analytics or Adsense.
If these scripts are coming from a domain other than your site's domain how does this all tie in with same origin policy (SOP) and cross-site scripting (XSS)? From what I understand about XSS and SOP, these scripts just shouldn't be able to run or interact with the DOM in your site. How come they are given special privileges? And how are these special privileges differentiated from other external scripts that cause errors in browsers due to XSS and SOP?
In a nutshell, I want to know why scripts from another domain are allowed to run, interact with and manipulate my site?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
你误解了这些政策。
SOP 防止页面（例如在框架中）与来自不同域的页面交互，或读取不同域中的资源（AJAX 请求）。
只要您显式加载它，在您的页面中执行来自不同域的脚本就没有任何问题。 （这就是 JSONP 的工作原理）但是，您无法读取脚本的源代码，因为那是来自不同域的资源。
浏览器安全限制基于执行代码的页面源，而不是特定
请注意，包含来自不同域的 Javascript 会授予该脚本对您页面的完全访问权限；它可以发送 AJAX 请求（到您的域）并通过向其他域发送非 AJAX 请求来窃取信息。
如果您信任该域，则仅包含来自不同域的脚本。
You're misunderstanding these policies.
SOP prevents a page (such as in a frame) from interacting with a page from a different domain, or from reading a resource (AJAX request) in a different domain.
There is nothing wrong with a script from a different domain executing in your page, as long as you explicitly load it. (that's how JSONP works) However, you can't read the script's source, since that's a resource from a different domain.
Browser security restrictions are based on the source of the page executing the code, not the site that a particular
<script>came from.Note that including Javascript from a different domain grants that script full access to your page; it can send AJAX requests (to your domain) and steal information by sending non-AJAX requests to other domains.
Only include a script from a different domain if you trust that domain.