跨域AJAX调用，是否授权对文件内容的所有请求？

Question

I want to provide other sites with a banner from my site but I want to keep the banner on my server and have them include it with javascript, like Facebook plugins/google ads do.

The banner is hosted on site A. On site BI have this code:

<div id="bannerContainer"></div>
<script type="text/javascript" src="http://mysite.com/plugins/includebanner.js"></script>

includebanner.js does an AJAX call to get the banner and place it inside bannerContainer but I'm getting error:

Origin http://lventas.com is not allowed by Access-Control-Allow-Origin.

How do I allow all websites to include the banner? Are there other easy ways to include a banner hosted in site A from other site?

Edit:

This is the script that requests the content:

function ajax(url, id_contenedor)
{
    var pagina_requerida = false;
    if (window.XMLHttpRequest)
    {
        pagina_requerida = new XMLHttpRequest ();
    } else if (window.ActiveXObject)
    {
        try 
        {
            pagina_requerida = new ActiveXObject ("Msxml2.XMLHTTP");
        }
        catch (e)
        {
            try
            {
                pagina_requerida = new ActiveXObject ("Microsoft.XMLHTTP");
            }
            catch (e)
            {
            }
        }
    } 
    else
    return false;
    pagina_requerida.onreadystatechange = function ()
    {
        cargarpagina (pagina_requerida, id_contenedor);
    }
    pagina_requerida.open ('GET', url, true); // asignamos los métodos open y send
    pagina_requerida.send (null);
}
function cargarpagina (pagina_requerida, id_contenedor)
{
    if (pagina_requerida.readyState == 4 && (pagina_requerida.status == 200 || window.location.href.indexOf ("http") == - 1))
    document.getElementById (id_contenedor).innerHTML = pagina_requerida.responseText;
}

ajax('http://lujanventas.com/plugins/banner/index.php', 'banner-root');

Answer 1

It appears you are running into the normal JS cross-site scripting restrictions. By default cross-site scripting capabilities apply some restrictions on what and who can call the endpoint. You didn't provide any sample of what you are trying to do code wise but you can check out this link as an example: http://jquery-howto.blogspot.com/2009/04/cross-domain-ajax-querying-with-jquery.html

EDIT:

It would help to see the JavaScript call itself but if you plugin the error to Google or Bing the first result for me was another SO post: XmlHttpRequest error: Origin null is not allowed by Access-Control-Allow-Origin

Answer 2

With javascript/jquery you can draw an iframe instead of a div, and set its src attribute to the url of your banner.

$('<iframe />', {
    name: 'myFrame',
    id:   'myFrame',
    src:  'http://www.mywebsite.com/'
}).appendTo('body');