Why are AJAX requests limited to same domain?

Picture this :

You come on my fabulous website www.halfnakedgirls.com. You have fun watching what looks like technical documentation on human physiology, but behind your back, some lines of JavaScript are executing some request to another domain, let's say www.yourpaypallike.com.

Requests like http://www.yourpaypallike.com/account/transfer?to=badguy@evilwebsite.com&amount=984654 or http://www.mymailprovider.com/mails/export?format=csv.

Do you now see why it is forbidden ? =)

Tom, it is not "Ajax request limited". AJAX is based on JavaScript. For security reason JavaScript is prohibited access on cross domains. If you really want to do cross domain Ajax, you can do a hack.

YourPage(Ajax) ----> YourServer ----> ExternalDomain

You can call a page in your server using Ajax, Your domain will call to external domain using server side , and get the result then return to you as Ajax response. Of course the request done to the ExternalDomain server will be called WITHOUT sending cookies for ExternalDomain that reside in your browser's memory. That's because the request is done by your server and not your browser.

It's for security purposes - if a website could execute AJAX calls to any domain they wanted on the client side, it poses a serious risk.

There are ways around this though - you could have your AJAX call a PHP script on the same domain, which in turn can call a script from another domain and return it. This wouldn't be using the browser as the communication medium though, it'd be using your web server.