[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

Re: Cross-domain loading of XML

• From: COUTHURES Alain <alain.couthures@agencexml.com>
• To: Mike Sokolov <sokolov@ifactory.com>
• Date: Wed, 08 Dec 2010 16:51:48 +0100

JSONP usually is using a callback function: the generated script element 
contains a call to this function with the corresponding JSON object as 
unique parameter.

The name of this callback function can usually be chosen by the developer.

Yes, the url has not to be in the same domain because script allows to 
load external javascript libraries.

The request parameters are passed as if filled in a form: GET method 
with ?param1=value1&param2=value2&... and so on

I have implemented this in XForms with my own implementation: 
http://www.agencexml.com/jsoncallback/wikipediasearch.xml

-Alain

Le 08/12/2010 15:21, Mike Sokolov a écrit :
> This article gives a pretty good explanation:
>
> http://www.ibm.com/developerworks/library/wa-aj-jsonp1/
>
> The gist is that XMLHttpRequest is limited to same-domain urls.
>
> However there is a workaround for JSON (they call it JSONP) that uses 
> the ability to load javascript dynamically from another domain.  
> Essentially, it seems you can bypass the cross-domain restriction by 
> this trick:
>
> var script = document.createElement('script');
> script.setAttribute('src', url);
>
> Apparently in this instance url doesn't have to be a url on the same 
> domain.
>
> I don't see why this couldn't be used to insert any sort of data at 
> all, but it does rely on javascript.
>
> -Mike
>
> On 12/08/2010 08:08 AM, Elliotte Rusty Harold wrote:
>> On Tue, Dec 7, 2010 at 7:15 PM, Rob Koberg<rob@koberg.com>  wrote:
>>
>>> First thing: Get the browser builders to allow cross domain loading of
>>> XML. Without that you might as just bang your head on a post. (even
>>> with that, you will just be banging your head on a padded post)
>> Just want to double check this. JSON can be loaded cross-domain and
>> XML can't, right? I.e. I can eval JSON from an arbitrary host in my
>> browser-based JavaScript and I can't load XML using XmlHTTPRequest
>> unless it comes from the same host? Or is it more subtle than that? If
>> so, is there a detailed analysis somewhere of exactly under what
>> conditions I can load JSON from where and how?
>>
>> Googling around I see some blog posts, but no detailed analysis.
>>
>
> _______________________________________________________________________
>
> XML-DEV is a publicly archived, unmoderated list hosted by OASIS
> to support XML implementation and development. To minimize
> spam in the archives, you must subscribe before posting.
>
> [Un]Subscribe/change address: http://www.oasis-open.org/mlmanage/
> Or unsubscribe: xml-dev-unsubscribe@lists.xml.org
> subscribe: xml-dev-subscribe@lists.xml.org
> List archive: http://lists.xml.org/archives/xml-dev/
> List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
>
>

• References:
  • Cross-domain loading of XML
    • From: Elliotte Rusty Harold <elharo@ibiblio.org>
  • Re: Cross-domain loading of XML
    • From: Mike Sokolov <sokolov@ifactory.com>