Question

Cross domain ajax requests are denied, but I can around it by this:

$(document).ready(function () {
  var data = ...;
  $('<img>').attr('src', 'http://domain.com?data=' + escape(data)).appendTo('body');
});

So if I really want I can send data to another domain. Also I can get data the same way, but on load I can for example move it on canvas and then read pixels.

So what is the point in this restriction and what it can save from?

Answer 1

So what is the point in this restriction and what it can save from?

The point is to prevent your site from reading data from a remote site, not to prevent it sending data.

For example, you can’t make my browser go to my bank and fetch my account details so you can send them to your webserver.

The same origin policy wouldn’t prevent you submitting a request that money be transfered to your server, but that is why sites have to implement defences against CSRF attacks.