Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am posting this question on Stack Overflow as well. In my opinion this question overlaps the two...

I am creating a simple JavaScript wrapper for CouchDB's REST-ful interface, but I am stuck on same-origin policy issues.

So far I've been developing my code to work locally - and only as a proof of concept - on Mozilla FireFox. My server is running on localhost, port 5984.

To disable cross-origin policy in Mozilla FireFox you can use the PrivilegeManager, but it only gets me half-way in the sense that I can't do PUT requests against my server...

 * Including this in my JavaScript file only seems to disable cross-origin
 * policy checks for POST and GET requests in Mozilla FireFox.
 * PUT requests fail.
    "UniversalBrowserRead UniversalBrowserWrite"

Is there any way that I can configure my server to hide it's location so I won't have to implement browser-specific work-arounds to avoid same-origin policy issues? If not: what browser work-arounds exist to disable same-origin policy completely?

share|improve this question
I think such questions are to be asked in SO. For server related queries there is another place ...i don't remember its name. May be some else could mention it for you – subanki Sep 7 '10 at 19:13

Same origin policies (SOPs) were developed to prevent injection of information from one context/domain to another. They are implemented and enforces by the browser. Each vendor may have his own SOPs. So any workaround may work for one browser while it will fail on another one.

IMHO the best (and only?) option is to use some kind of proxy.

If you are using Apache for hosting your webapp you can easily set up a reverse proxy. I accepts requests and sends them to the real service (REST-API). The response will be send back to the Browser. The SOP won't apply since the endpoint of the REST-API won't be in another domain (i.e. another server) but in the domain of your webapp (thanks to the proxy).

[edit] Here's a better explanation:

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .