I have https://domain1.com (domain1) and https://domain2.com (domain2).
Domain2 serves a page containing javascript with this header:
"Access-Control-
Note : The URI passed as parameter of the Worker constructor must obey the same-origin policy. There is currently disagreement among browsers vendors on what URIs are of the same-origin; ...
Quote from https://developer.mozilla.org/en-US/docs/Web/Guide/Performance/Using_web_workers
The HTML5 Worker is a fairly new concept and I'm not sure how same-origin exceptions apply, however, with XmlHttpRequest
, it's possible to access resources on a different domain if you have control over the the server it runs on. Resources on foreign domains are accessed via preflighted requests meaning that first an OPTIONS request is sent to resource and if the response to that has the appropriate access control headers (Access-Control-Allow-Methods
, Access-Control-Allow-Origin
as a minimum), then the request is repeated with the original method and receives the resource in response.