Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Doesn’t Google Violate the same origin policy when it tries to access the KML files from a globally accessible server? The condition for Google maps to display the KML is that it should be globally accessible. Now their are 2 problems with this:

  1. Security of the KML files. (This can be avoided by using geoXML3)
  2. Violating the Same-Origin Policy.

Is their a way around to the same-origin policy? How does google parse the KML file?


share|improve this question
A marginally related point from the W3C: – BradHards Aug 9 '12 at 10:21

From the Google Maps premier FAQ:

The KmlLayer class that generates KML overlays in the Google Maps API uses a Google hosted service to retrieve and parse KML files for rendering. Consequently it is not possible to display KML files that are not hosted at a URL that is available publicly accessible, or that require authentication to access.

If you need to develop applications that use KML files hosted on intranet sites we recommend that you either:

Use the Google Earth API which supports client side parsing and rendering of KML.

Render the KML on the client side by using third-party JavaScript libraries. As the KML file is analyzed by the browser, performance may be lower than by using the KmlLayer class.

This doesn't breach the same-origin policy as the files are sent to the browser from a Google server rather than the original source server of the KML URL.

You could consider making URLs that are very difficult to guess such as using a different GUID for each request. But you would still need to trust Google to securely handle your kml and keep it secret.

share|improve this answer
I am still confused - Does google download the KML file on its local server and parse it and display it on Google map ? – Vinit Parakh Aug 9 '12 at 12:35
@Vinit. yes that is correct. – Matthew Snape Aug 9 '12 at 13:40
Thanks :). I got it now. – Vinit Parakh Aug 9 '12 at 14:09
The GeoXML3 documentation says - "Geoxml3 is subject to the same cross-domain download restrictions as any JavaScript, so any KML document you expect it to process will need to be served from the same domain as the containing map page. Then my question is how does Google get around this? – Vinit Parakh Aug 10 '12 at 5:42
It does not break the same-origin policy as the files are going through Google's servers. The origin refers to the actual URL that the browser is requesting. – Matthew Snape Aug 10 '12 at 11:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.