diff --git a/1-js/12-generators-iterators/1-generators/genYield2-2.svg b/1-js/12-generators-iterators/1-generators/genYield2-2.svg index 494026b3..c8a39b4a 100644 --- a/1-js/12-generators-iterators/1-generators/genYield2-2.svg +++ b/1-js/12-generators-iterators/1-generators/genYield2-2.svg @@ -1,11 +1,11 @@ - + genYield2-2.svg Created with sketchtool. - + diff --git a/3-frames-and-windows/03-cross-window-communication/article.md b/3-frames-and-windows/03-cross-window-communication/article.md index b474b8cd..0a89521b 100644 --- a/3-frames-and-windows/03-cross-window-communication/article.md +++ b/3-frames-and-windows/03-cross-window-communication/article.md @@ -118,7 +118,7 @@ That's all. Now they can interact without limitations. Again, that's only possib ## Iframe: wrong document pitfall -When an iframe comes from the same origin, and we may access its `document`, there's a pitfall. It's not related to cross-domain things, but important to know. +When an iframe comes from the same origin, and we may access its `document`, there's a pitfall. It's not related to cross-origin things, but important to know. Upon its creation an iframe immediately has a document. But that document is different from the one that loads into it! @@ -326,7 +326,7 @@ window.addEventListener("message", function(event) { } alert( "received: " + event.data ); - + // can message back using event.source.postMessage(...) }); ``` diff --git a/5-network/03-fetch-progress/article.md b/5-network/03-fetch-progress/article.md index 84ad1cbe..b26a8a0c 100644 --- a/5-network/03-fetch-progress/article.md +++ b/5-network/03-fetch-progress/article.md @@ -91,7 +91,7 @@ Let's explain that step-by-step: Please note, we can't use both these methods to read the same response: either use a reader or a response method to get the result. 2. Prior to reading, we can figure out the full response length from the `Content-Length` header. - It may be absent for cross-domain requests (see chapter ) and, well, technically a server doesn't have to set it. But usually it's at place. + It may be absent for cross-origin requests (see chapter ) and, well, technically a server doesn't have to set it. But usually it's at place. 3. Call `await reader.read()` until it's done. We gather response chunks in the array `chunks`. That's important, because after the response is consumed, we won't be able to "re-read" it using `response.json()` or another way (you can try, there'll be an error). diff --git a/5-network/05-fetch-crossorigin/article.md b/5-network/05-fetch-crossorigin/article.md index e88dcc25..2d7c20c7 100644 --- a/5-network/05-fetch-crossorigin/article.md +++ b/5-network/05-fetch-crossorigin/article.md @@ -1,10 +1,6 @@ # Fetch: Cross-Origin Requests -If we make a `fetch` from an arbitrary web-site, that will probably fail. - -The core concept here is *origin* -- a domain/port/protocol triplet. - -Cross-origin requests -- those sent to another domain (even a subdomain) or protocol or port -- require special headers from the remote side. That policy is called "CORS": Cross-Origin Resource Sharing. +If we send a `fetch` request to another web-site, it will probably fail. For instance, let's try fetching `http://example.com`: @@ -18,19 +14,25 @@ try { Fetch fails, as expected. -## Why? A brief history +The core concept here is *origin* -- a domain/port/protocol triplet. -Because cross-origin restrictions protect the internet from evil hackers. +Cross-origin requests -- those sent to another domain (even a subdomain) or protocol or port -- require special headers from the remote side. + +That policy is called "CORS": Cross-Origin Resource Sharing. + +## Why CORS is needed? A brief history + +CORS exists protect the internet from evil hackers. Seriously. Let's make a very brief historical digression. **For many years a script from one site could not access the content of another site.** -That simple, yet powerful rule was a foundation of the internet security. E.g. a script from the page `hacker.com` could not access user's mailbox at `gmail.com`. People felt safe. +That simple, yet powerful rule was a foundation of the internet security. E.g. an evil script from website `hacker.com` could not access user's mailbox at website `gmail.com`. People felt safe. JavaScript also did not have any special methods to perform network requests at that time. It was a toy language to decorate a web page. -But web developers demanded more power. A variety of tricks were invented to work around the limitation. +But web developers demanded more power. A variety of tricks were invented to work around the limitation and make requests to other websites. ### Using forms @@ -50,34 +52,36 @@ One way to communicate with another server was to submit a `
` there. Peopl
``` -So, it was possible to make a GET/POST request to another site, even without networking methods. But as it's forbidden to access the content of an `