The other day I had to debug a JavaScript UWA that was failing when trying to use an undefined property. In a previous OS build this code would run and the property was defined. I wanted something similar to windbg/cdb's ba command that lets me set a breakpoint on read or writes to a memory location so I could see what was creating the object in the previous OS build and what that code was doing now in the current OS build. I couldn't find such a breakpoint mechanism in Visual Studio or F12 so I wrote a little script to approximate JavaScript data breakpoints.
The script creates a stub object with a getter and setter. It actually performs the get or set but also calls debugger; to break in the debugger. In order to handle my case of needing to break when window.object1.object2 was created or accessed, I further had it recursively set up such stub objects for the matching property names.
Its not perfect because it is an enumerable property and shows up in hasOwnProperty and likely other places. But for your average code that checks for the existence of a property via if (object.property) it works well.
TL;DR: Web content in a JavaScript Windows Store app or WebView in a Windows Store app that has full access to WinRT also gets to use XHR unrestricted by cross origin checks.
By default web content in a WebView control in a Windows Store App has the same sort of limitations as that web content in a web browser. However, if you give the URI of that web content full access to WinRT, then the web content also gains the ability to use XMLHttpRequest unrestricted by cross origin checks. This means no CORS checks and no OPTIONS requests. This only works if the web content's URI matches a Rule in the ApplicationContentUriRules of your app's manifest and that Rule declares WindowsRuntimeAccess="all". If it declares WinRT access as 'None' or 'AllowForWebOnly' then XHR acts as it normally does.
In terms of security, if you've already given a page access to all of WinRT which includes the HttpRequest class and other networking classes that don't perform cross origin checks, then allowing XHR to skip CORS doesn't make things worse.
My parents visited this past weekend, met Sarah's parents, saw our house, and met our bunny. On Friday we went to BluWater in Kirkland which was pretty busy and the service was slower and slightly worse than we usually find. Saturday my parents helped us with our yard quite a bit and for dinner we went to the Icon Grill with Sarah's parents. I had forgotten how much I enjoy the food at the Icon Grill - I had the very tasty meat loaf. Dinner went well and afterward we stopped at the Three Lions pub in Redmond. On all previous occasions I had tried to go in there the place was packed for a soccer game. This night however there was a man with a guitar, singing and it wasn't nearly as packed. I also found that near the bathrooms on the wall is what looks to be James Bond's jetpack.
On Sunday we went out to see Jeannie and Carl and see the renovations to Jeannie's place. We met up with them at the Fremont Market to which I hadn't been previously, and had a look around there before going back to Jeannie's to see the lovely work they'd done to her place. For dinner my parents took us out to the Melting Pot for my approaching birthday. It was fun having my parents up and I look forward to the next time they're here.
Last weekend after Saul and Ciera's wedding, I drove up to Pat, Grib, and Jesse's house to which I hadn't previously been. I got in late and they'd just finished a UFC party. The next day Grib had to travel for work but the rest of us met Scott and Nicole, Jesse's girlfriend at a place for breakfast. After that we went back to their place for some Rock Band which I hadn't played previously and Pat took the opportunity to show off his real life musical skills on the banjo.
This weekend, Jesse and Nicole are up visiting Seattle. On Friday, Sarah and I met up with them at the BluWater Bistro in Seattle which sits right on Lake Union. The view was nice although difficult to see from our table and overall I like the sister restaurant in Kirkland better. They were both short visits but it was fun to see people again.