Question: is ajax same origin policy?
Answer: This is a result of something known as “same-origin policy”. This means that an AJAX request made from one domain (for instance, google.com) can only access other endpoints hosted on google.com. Here's a snippet from MDN: For security reasons, browsers restrict cross-origin HTTP requests initiated from within scripts.