第 3 方 javascript 设置 document.cookie

Question

Here is the situation I'm trying to figure out:

I have page 'ABC.html' that is loaded from foo.com/ABC.html. It has a script tag that loads javascript from bar.com. The javascript loaded from bar.com sets document.cookie to something say: "baz => cookieValue" and it DOES NOT set the domain.

If I understand correctly, because a domain wasn't specified, when setting document.cookie, the cookie defaults to the origin domain of 'foo.com'.

So now, page ABC.html has its own javascript and in this javascript it's going to make an ajax call.

My question is: when it makes that ajax call does it send the "baz => cookieValue" cookie set from the javascript loaded from bar.com?

Thank you for any help.

Answer 1

No cookie gets set for bar.com; the cookie is set for foo.com and will be included in the AJAX connection to foo.com.

The script executes in the foo.com origin, no matter where it was loaded from. Only iframes and pop-up windows can execute scripts in different origins from the parent page.