Cross-Domain Ajax. Security Implications in Depth

[Ajaxking]

Some people think we should remove the "same-domain" restriction from Ajax calls, and Eric Pascarello and xml.com (amongst others) don't. I don't think we've got to the bottom of the debate yet.

Eric has 2 points:

• "script kiddies", although he doesn't elaborate on how cross-domain XHR will help them.
• and the problem of slow 3rd party websites, which proxying and caching can solve.

more...