Security Gotchas

• XMLHTTPRequest can only call URLs from the originating domain
• IE’s XMLHTTPRequest depends on Active-X being available