views:

737

answers:

5

I have an environment that doesn't allow server side scripting really (it is extremely difficult to get a script "installed" on the server). I tried using an iframe to violate javascript's same origin poilcy; however, that didn't work. Are there any other workarounds I am not aware of?

Thanks!

+2  A: 

Hopefully not, as it would be a security hole! :)

But if both your sites are subdomains on the same domain, maybe document.domain can help.

Pekka
So if my domain is awesome.yahoo.com, for instance, and i am trying to access bob.yahoo.com, i could set document.domain to yahoo.com and then be able to access bob.yahoo.com?
Parris
Also I do realize it is a security hole; however, I was hoping that there was a hole hahaha. If you think about it using a proxy allows for a workaround. I dont understand why using a proxy is allowed while just accessing the file directly is not allowed. Also I heard html 5 has some attributes that also allows for cross-domain stuff.
Parris
A proxy won't send the users cookies or any other authentication data to the remote site - since it can't know what they are. It can only get data that the site could get anyway. It can't pretend to be the user. There is ongoing work to develop a permissions system so that XHR can access remote sites, browser support is currently weak.
David Dorward
Ahhh that makes sense. I had not considered that type of stuff.
Parris
+1  A: 

JSON-P is the simplest solution, and the only one (AFAIK) that doesn't require browser plugins (such as Flash).

This does require the cooperation of whomever runs the different origin site.

David Dorward
Right, I had heard of JSON-P, but in this groups case they don't want to bother the other groups. Thanks for the tip though I will look into it more. Perhaps it is doable...
Parris
+1  A: 

As David Dorward mentioned, JSON-P is the simplest and fastest; however, there is another trick, specifically using two iframes. If you're interested or JSONP is not an option, I can go into further implementation details of the later technique.

Justin Johnson
Actually yea please tell me!! :)
Parris
I'm actually going to write up something rather complete. Check back later.
Justin Johnson
So what's the downvote for?
Justin Johnson
someone gave you a down vote?
Parris
A: 

Sooo as an update. I found out about: YQL from http://ajaxian.com/archives/using-yql-as-a-proxy-for-cross-domain-ajax

It will grab whatever url you specify and wrap it in JSON and return back. You could then use jquery's getJSON function to grab that url. It seems to be working :)!

Parris
A: 

Just use easyXDM, it's a library that enables cross-domain messaging with very little coding, and it doesn't need any server components.

Sean Kinsey