Does Google Violate the same origin policy when it tries to access the KML files from a globally accessible server?

The condition for Google maps to display the KML is that it should be globally accessible. Now there are 2 problems with this:

  1. Security of the KML files. (This can be avoided by using geoXML3)
  2. Violating the Same-Origin Policy.

Is there a way around to the same-origin policy?

How does google parse the KML file?

closed as too broad by PolyGeo May 29 at 8:46

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


From the Google Maps premier FAQ:

The KmlLayer class that generates KML overlays in the Google Maps API uses a Google hosted service to retrieve and parse KML files for rendering. Consequently it is not possible to display KML files that are not hosted at a URL that is available publicly accessible, or that require authentication to access.

If you need to develop applications that use KML files hosted on intranet sites we recommend that you either:

Use the Google Earth API which supports client side parsing and rendering of KML.

Render the KML on the client side by using third-party JavaScript libraries. As the KML file is analyzed by the browser, performance may be lower than by using the KmlLayer class.

This doesn't breach the same-origin policy as the files are sent to the browser from a Google server rather than the original source server of the KML URL.

You could consider making URLs that are very difficult to guess such as using a different GUID for each request. But you would still need to trust Google to securely handle your kml and keep it secret.

  • I am still confused - Does google download the KML file on its local server and parse it and display it on Google map ? – Vinit Parakh Aug 9 '12 at 12:35
  • @Vinit. yes that is correct. – Matthew Snape Aug 9 '12 at 13:40
  • The GeoXML3 documentation says - "Geoxml3 is subject to the same cross-domain download restrictions as any JavaScript, so any KML document you expect it to process will need to be served from the same domain as the containing map page. Then my question is how does Google get around this? – Vinit Parakh Aug 10 '12 at 5:42
  • It does not break the same-origin policy as the files are going through Google's servers. The origin refers to the actual URL that the browser is requesting. – Matthew Snape Aug 10 '12 at 11:04
  • Google must be having a javascript similar to geoxml i suppose which parses the KML that we provide,right? But when google is trying to access the KML from the url that we provide, isnt it trying to access something which is not in its domain, from the javascript? – Vinit Parakh Aug 10 '12 at 11:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.