title: Why will disabling Browser Web Security (e.g. Chrome) help doing Cross-Site-Requests?
body: <p>We have several internal web applications. One of those needs to access all the other applications. Problem is: <strong>Same-Orign-Policy</strong>.</p>
  
  <p>Actually I did manage to get around it. First of all, the IE is quite sloppy what concerns web security. So, it actually asked me whether I want to have these requests done or not. If I clicked yes, he just executed the cross site requests.</p>
  
  <p>But since most of the users won't use IE, there was the need to make it run in another browser. 
  So, I tried to make it run in Google Chrome. And after some research I found out, that it will work when I turn of the Web Security by using the execution parameter <code>--disable-web-security</code>.
  This did the job. But unfortunately, most of the users won't be using this execution parameter. Therefore I need another solution.</p>
  
  <p>Then I came across <strong>CORS</strong>. CORS seems to be implemented in Chrome, but it has one drawback (for me). I need to set headers on the server side.
  For reasons I won't discuss in here, this is a no go.</p>
  
  <p>So what I was actually wondering about is:</p>
  
  <p><em>Why will disabling Browser's Web Security do the job, while I need the server to allow the request when using CORS?</em></p>
  
  <ol>
  <li><p>What exactly happens inside the browser when I disable the web security?</p></li>
  <li><p>And is there another way to execute my CSR without adding headers on the server's side or disabling the security?</p></li>
  </ol>
  
  <p>Thanks in advance</p>
  
  <p><strong>EDIT:</strong> JSONP is out of question either</p>