KML with Google Maps : Google violates same origin policy?

Question

Doesn’t Google Violate the same origin policy when it tries to access the KML files from a globally accessible server? The condition for Google maps to display the KML is that it should be globally accessible. Now their are 2 problems with this:

1. Security of the KML files. (This can be avoided by using geoXML3)
2. Violating the Same-Origin Policy.

Is their a way around to the same-origin policy? How does google parse the KML file?

Thankyou.

Answer 1

From the Google Maps premier FAQ:

The KmlLayer class that generates KML overlays in the Google Maps API uses a Google hosted service to retrieve and parse KML files for rendering. Consequently it is not possible to display KML files that are not hosted at a URL that is available publicly accessible, or that require authentication to access.

If you need to develop applications that use KML files hosted on intranet sites we recommend that you either:

Use the Google Earth API which supports client side parsing and rendering of KML.

Render the KML on the client side by using third-party JavaScript libraries. As the KML file is analyzed by the browser, performance may be lower than by using the KmlLayer class.

This doesn't breach the same-origin policy as the files are sent to the browser from a Google server rather than the original source server of the KML URL.

You could consider making URLs that are very difficult to guess such as using a different GUID for each request. But you would still need to trust Google to securely handle your kml and keep it secret.