This is an interesting hack: a host script can communicate with scripts in an iframe via the postMessage API and relying on the fact that a script running in the frame can make same-domain requests.
I am worried that people will choose this option just because it is easier rather than use what is technically the right thing to do. (CORS) Please don't use this unless you really have to. The arguments against CORS in the Readme aren't really compelling. The web is messy enough as it is.
I am worried that people will choose this option just because it is easier rather than use what is technically the right thing to do. (CORS) Please don't use this unless you really have to. The arguments against CORS in the Readme aren't really compelling. The web is messy enough as it is.