Peter Lubbers - Pro HTML 5 Programming

Figure 5-4. Difference between client-side and server-side aggregation
CHAPTER 5 ■ USING THE COMMUNICATION APIS
The CORS specification dictates that, for sensitive actions—for example, a request with credentials,
or a request other than GET or POST—an OPTIONS preflight request must be sent to the server by the
browser to see whether the action is supported and allowed. This means that successful communication
may require a CORS-capable server. Listings 5-5 and 5-6 show the HTTP headers involved in a crossorigin
exchange between a page hosted on www.example.com and a service hosted on www.example.net.
Listing 5-5. Example request headers
POST /main HTTP/1.1
Host: www.example.net
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090910 Ubuntu/9.04
(jaunty) Shiretoko/3.5.3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://www.example.com/
127