Home/ Questions/Q 554787
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T11:44:50+00:00

I read the question here in SO jQuery Linking vs. Download and I somehow

  • 0

I read the question here in SO “jQuery Linking vs. Download” and I somehow don’t get it.

What happens if you host a page on http://yourserver.com, but load jQuery library from http://ajax.googleapis.com and then use the functions defined in jQuery script?

Does “same origin policy” not count in this case? I mean, can you make AJAX calls back to http://yourserver.com?
Is the JavaScript being executed considered as coming from yourserver.com?

My point here is, you do not know what the user has downloaded from some third party server (sorry, Google), and still the code executing on his computer is as good as the one he would download from your server?

EDIT: Does it mean _that if I use a web statistics counter from a 3rd party I don’t know very well, they might “inject” some code and call into my web services as if their code was part of mine?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The owner of site http://yourserver.com/ should trust the content it references from other servers (in this case, Google’s). The same origin policy doesn’t apply to “script” tags.

    Of course, the scripts of the foreign servers (once loaded) have access to the whole DOM: so, if the foreign content is compromised, there can be security exposures.

    As with many things in the web world, it comes down to trust and continuous management.

    Edit:

    Does it mean _that if I use a web
    statistics counter from a 3rd party I
    don’t know very well, they might
    “inject” some code and call into my
    web services as if their code was part
    of mine?

    Yes.

    • 0