[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Maximally Consumable Data

• From: Elliotte Harold <elharo@m...>
• To: "Costello, Roger L." <costello@m...>
• Date: Mon, 07 Apr 2008 05:25:25 -0700

Costello, Roger L. wrote:

> If the data is formatted as XML then Ajax is limited to fetching data
> from the same domain (website) that the Ajax application came from.

True.

> If the data is formatted as JSON then Ajax can travel across domains.
> That is, Ajax can access data from anywhere. Think of the power of
> this: a single Ajax application, running in your browser, can reach out
> and grab data from an unlimited number of web services, and present it
> in your browser in a coherent fashion. Awesome!
> 

Are you sure about this? Can you elaborate? Exactly how is this done, 
and why is this allowed? It sounds like a security hole waiting to happen.

Why are we allowing the browser to pull executable script code (JSON) 
from multiple domains but not allowing it to pull data (XML) from 
multiple domains?

-- 
Elliotte Rusty Harold  elharo@m...
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/

• References:
  • Maximally Consumable Data
    • From: "Costello, Roger L." <costello@m...>
  • Re: Maximally Consumable Data
    • From: "bryan rasmussen" <rasmussen.bryan@g...>
  • RE: Maximally Consumable Data
    • From: "Costello, Roger L." <costello@m...>