Why Visualforce pages are served from a different domain in Salesforce?

Hi Laveena,

Visualforce pages are served from a different domain in salesforce because of Security. Salesforce wants to keep tight control over what is customizable and what is not. Consider an example of a Visual force page running within your standard page-layout. If it runs in the same domain, the scripts in the VF page will be able to access the scripts on the standard page-layout and will be able to manipulate it.

As a matter of fact there used to be a side-bar hack where users could run scripts from side-bar and manipulate standard pages, which has since been disabled by ensuring all scripts and vf pages run in a different domain.

Thanks.