There is a same origin policy and CORS.  Sometimes cross site stuff is supposed to work (JSONP).  In some cases the request is made to the non-origin site, and the response is then blocked based on returned headers.  That however doesn&#x27;t stop the request&#x27;s side effects.  A few years ago there were a round of hacks against many home routers doing this, exploiting vulnerabilities in their web admin interfaces.  I stand by my first sentence in my first comment.