title: Cross domain requests: Javascript vs Flash
body: <p>As you might know, browser's security model does not allow a script loaded in a page from <a href="http://www.example.com" rel="nofollow noreferrer">http://www.example.com</a> to make cross-domain requests (no AJAX calls to any other domain other than www.example.com). The Javascript file itself could have been served from a different domain altogether (www.javascript.com/myscript.js) and that is irrelevant. This is the Same-Origin Policy.</p>
  
  <p>Flash also has something similar? But does Flash treat the origin to be the HTML page where the .swf file was <strong>loaded</strong> or origin is the domain which <strong>served</strong> the .swf file? </p>
  
  <p>So <a href="http://www.example.com" rel="nofollow noreferrer">http://www.example.com</a> loads a .swf file from <a href="http://www.swf.com/myflash.swf" rel="nofollow noreferrer">http://www.swf.com/myflash.swf</a>. Now .swf can load resources only from www.example.com or only www.swf.com? I'm assuming there are no cross-domain.xml files setup on either example.com or swf.com.</p>