Why is the HTML SCRIPT tag not subject to the same origin policy
I suppose this draft titled “Principles of the Same-Origin Policy” explains (albeit briefly) what’s pretty much in everyone’s head: In principle, user agents could treat every URL as a separate principal and isolate each document from every other URL unless the document explicitly indicated that it trusted that URL. Unfortunately, this design is cumbersome for … Read more