title: What are the security risks in using cross-domain XMLHttpRequest?
body: <p>In many places I've seen people have talked about the Cross-Domain XMLHttpRequest, which is not possible, due to some <strong>security reasons</strong>. However, I haven't found a post indicating what those <strong>security reasons</strong> actually are?</p>
  
  <p>People have mentioned that JSONP is one of the good alternatives. Another alternative would be to use <code>Origin</code> and <code>Access-Control-Allow-Origin</code> headers.</p>
  
  <p>However, I just want to know what security problems can be raised due to cross-domain XMLHttpRequest usage?</p>