javascript - Why are AJAX requests limited to same domain?

Question

Something I find really confusing, is why are AJAX requests limited to the same domain? What is the reasoning behind this?

I don't see any problem with requesting files from external locations, also servers making XMLHTTP requests seem to get and post to external locations fine.

Answer 1

Picture this :

You come on my fabulous website www.halfnakedgirls.com. You have fun watching what looks like technical documentation on human physiology, but behind your back, some lines of JavaScript are executing some request to another domain, let's say www.yourpaypallike.com.

Requests like http://www.yourpaypallike.com/account/transfer?to=badguy@evilwebsite.com&amount=984654 or http://www.mymailprovider.com/mails/export?format=csv.

Do you now see why it is forbidden ? =)