javascript - Same-origin policy is for what -

i not able understand why need rule. if such import, why can many workaround address it? jsonp, cors etc.?

is there example can demostrate damage without rule?

if @ mdn article, you'll see this:

cross-origin writes typically allowed. examples links, redirects , form submissions. used http requests require preflight.

cross-origin embedding typically allowed. examples listed below.

cross-origin reads typically not allowed, read access leaked embedding. example can read width , height of embedded image, actions of embedded script, or availability of embedded resource.

here's post on security stackexchange:

assume logged facebook , visit malicious website in browser tab. without same origin policy javascript on website facebook account allowed do. example read private messages, post status updates, analyse html dom-tree after entered password before submitting form.

regarding question why there cors, jsonp, etc. (i.e., ways around same-origin policy): allows domains specify ways other origins access apis (read content, etc.) cors, example, allows servers specify whitelist of safe domains allowed to, say, read server.