关于XMLHttpRequest open()方法url参数（相对/绝对）的疑问

Great question! Let's break this down clearly because getting a handle on relative vs absolute URLs here is key to avoiding common request errors.

First off, you're totally right—for same-origin requests (like your page.html calling controller.php on your own server), you don't need to include the full domain. The URL you use can be either relative or absolute, and the browser follows specific rules to resolve it correctly.

Core Rule: Relative URLs are resolved against the current page's URL #

This is the most important point to remember: relative paths in open() are based on the URL of the page that's running the JavaScript (your page.html), not the location of the JS file itself. That's a common gotcha if you're using external scripts!

Let's break down the different URL types and their behavior: #

• Simple relative path (e.g., controller.php):
  This points to a file in the same directory as the current page. For example:

  • If page.html is at http://mywebsite.com/blog/page.html, the request goes to http://mywebsite.com/blog/controller.php.
  • Use this when the PHP script is in the same folder as your HTML page.

• Parent-directory relative path (e.g., ../controller.php):
  The ../ tells the browser to move up one directory level from the current page's location. For example:

  • If page.html is at http://mywebsite.com/blog/posts/page.html, the request goes to http://mywebsite.com/blog/controller.php.
  • Useful when your PHP scripts are organized in a parent folder relative to your HTML pages.

• Root-relative path (e.g., /controller.php):
  The leading slash makes this path relative to the root directory of your domain. No matter where page.html is located, this will always point to the root-level controller.php. For example:

  • If page.html is at http://mywebsite.com/blog/posts/page.html, the request goes to http://mywebsite.com/controller.php.
  • This is super handy for large sites with nested directories, as it avoids having to adjust paths based on where the page lives.

• Full absolute path (e.g., http://www.mywebsite.com/controller.php):
  This works too, but it's unnecessary for same-origin requests. The downsides are:

  • If you ever switch your domain, or move from HTTP to HTTPS, you'll have to update all these URLs.
  • If your page uses HTTPS but you specify an HTTP URL, browsers will block the request due to mixed-content restrictions.

How to test the resolved URL #

If you're ever unsure where a relative path will point, you can test it in your browser's console using the URL constructor:

// This uses your current page's URL automatically
const resolvedUrl = new URL('controller.php', window.location.href);
console.log(resolvedUrl.href); // Shows the full absolute URL the browser will use

Quick reminder on same-origin policy #

Just to confirm what you noted: browsers only allow XHR requests to the same origin (same protocol, domain, and port). All the path types above resolve to the same origin as your page.html, so they're all safe to use.

内容的提问来源于stack exchange，提问作者JacopoStanchi