title: Cross domain AJAX call and Access-Control-Allow-Origin
body: <p>I understand that you are not allowed to make cross domain Ajax calls, but why is it that I can make a cross domain ajax call to facebook's (or twitter or others) oauth API?</p>
  
  <p>Does this have to do with the following? </p>
  
  <pre><code>"Access-Control-Allow-Origin: *"
  </code></pre>
  
  <p>Is allowing all access like this bad practice? Is there a better way to allow only people who you authorize?</p>
  
  <p>Thanks!</p>