diff --git a/csrf-magic.js b/csrf-magic.js
index 0989c10..27fd4d7 100644
--- a/csrf-magic.js
+++ b/csrf-magic.js
@@ -27,6 +27,8 @@ CsrfMagic = function(real) {
 CsrfMagic.prototype = {
 
     open: function(method, url, async, username, password) {
+        // track for cross-domain check.
+        this.csrf_reqUrl = url;
         if (method == 'POST') this.csrf_isPost = true;
         // deal with Opera bug, thanks jQuery
         if (username) return this.csrf_open(method, url, async, username, password);
@@ -46,7 +48,15 @@ CsrfMagic.prototype = {
     //        delete this.csrf_purportedLength;
     //    }
         delete this.csrf_isPost;
-        return this.csrf_send(prepend + data);
+
+        // Avoid token send for cross-domain requests
+        var crossDomain = false;
+        if (this.csrf_reqUrl && this.csrf_reqUrl.indexOf("://") >= 0 && this.csrf_reqUrl.indexOf(location.origin) !== 0) {
+            crossDomain = true;
+        }
+        delete this.csrf_reqUrl;
+        
+        return this.csrf_send( (crossDomain ? "" : prepend) + data);
     },
     csrf_send: function(data) {
         return this.csrf.send(data);