title: document.domain and cross-site-scripting
body: <p>Debugging assistance requested.</p>
  
  <p>The page <a href="http://www.freshfaves.com/newfave.html" rel="nofollow noreferrer">http://www.freshfaves.com/newfave.html</a> contains this code:</p>
  
  <pre><code>&lt;script&gt;
  document.domain = 'freshfaves.com';
  $(document).ready(function() {
      var dbUrl = 'http://freshfaves.com/';
      var result = '';
      $.ajax({
              type: "POST",
              url: dbUrl,
              data: [], //params,
              async: false,
              dataType: "text",
              success: function(d,status) { result = d; return false; },
              error: function(xmlhttp,errmsg) { result = errmsg; return false; }
      });
      alert('result: '+result);
  });
  &lt;/script&gt;
  </code></pre>
  
  <p>To my understanding, the XMLHttpRequest cross-site restraints are checked based on the document.domain value, and that value is set to what is both a valid suffix of the current page url, and an exact match to the site hosting the requested page.</p>
  
  <p>This is a cross-site request, in that www.freshfaves.com and freshfaves.com are on different hosts.  The result is an alert box displaying 'result: error'.  The weblogs on the other site show that the request was not received there, so it apparently errored before the request was sent.</p>
  
  <p>If I change the dbUrl to '<a href="http://www.freshfaves.com/" rel="nofollow noreferrer">http://www.freshfaves.com/</a>', the request succeeds, so the problem seems closely related to the url, and is not a bug elsewhere in the code.</p>