JavaScript and 'same origin'

Question

I thought that I understood the same origin policy, but then my code worked...who would have thought?

I have a multiplayer game written in JavaScript that communicates with the backend using the Strophe XMPP library. It works great even thou the game is hosted at one machine and the XMPP server at another.

Basically I run my game on localhost, but the Strophe connection goes to a different machine and port. How is that possible?

Strophe uses long-polling XHR requests, and no, I do not use the Flash fallback.

Answer 1

The server can opt in to allow cross origin requests with Cross-origin resource sharing (CORS). CORS wikipedia. CORS MDN