the same origin policy should not be treated as single site policy.

For security reason, the same origin policy is good, but at present,
it is implemented as the single site policy. I think that we can
extend the de facto "single site policy" to the authentic "same origin
policy", i.e. to define origin explicitly. More specific, we can
define an origin be a set of url (which specifies the protocal, host,
and port).

More specifically, when you are at http://www.abc.com/something.html,
you want to access http://www.def.com/otherthing.html. Cross Origin is
a control at the server side of http://www.def.com, while cross domain
restriction is at the browser side which does not allow to access the
2nd resource. We need a specification at http://www.abc.com to specify
what other resources should be allowed to access at the browser side.
However, at present, there is no such specification although we really
need such a specification.

In fact, I think that this is easy to specify. In the html head, we
can specify additional domains should be allowed to access. Browsers
read these, then the original domain and the additional domains are
all deemed to be the same origin. Currently, it is the browser block
us. I am at http://www.abc.com/something.html, then I access
http://www.def.com/otherthing.html, with ajax (xmlhttprequest), use
firefox, I can clearly see that the remote server returns everything,
and everything is good, but the browser does not allow me to access
the content.

If my above proposal is accepted and implemented, then the problem is
sovled, and security is not jeopodized.

Even more specific, follows the above example.

If in the head part of the http://www.abc.com/something.html includes
the following line
<link href="http://www.def.com/" origin="same"/>

and the web browser can read this, and understand this, and take
http://www.def.com/ and http://www.abc.com/ to be the same origin.

Only in this way, the same origin policy is authentic, otherwise, it
should be called "the single site policy", rather than "the same
origin policy". And when there is no such line, then it degenerates to
"the single site policy".