I'm looking at this question and on it is a link to http://hacks.mozilla.org/2011/03/the-shortest-image-uploader-ever/ which has the following code:

 var fd = new FormData(); fd.append("image", file); // Append the file fd.append("key", "6528448c258cff474ca9701c5bab6927"); // Get your own key: http://api.imgur.com/ // Create the XHR (Cross-Domain XHR FTW!!!) var xhr = new XMLHttpRequest(); xhr.open("POST", "http://api.imgur.com/2/upload.json"); // Boooom! xhr.onload = function() { // Big win! // The URL of the image is: JSON.parse(xhr.responseText).upload.links.imgur_page; } // Ok, I don't handle the errors. An exercice for the reader. // And now, we send the formdata xhr.send(fd); 

How does this cross domain request work? I thought as a rules the're security restrictions that stop people from doing just this.