Simon Willison's Weblog: crossdomain

flXHR

2009-11-26T12:52:16+00:00

I was looking for something like this recently, glad to see it exists. flXHR is a drop-in replacement for regular XMLHttpRequest which uses an invisible Flash shim to allow cross-domain calls to be made, taking advantage of the Flash crossdomain.xml security model.

Tags: ajax, crossdomain, flash, flxhr, javascript, swf, xhr, xmlhttprequest

Firefox 3.5 for developers

2009-06-30T18:08:34+00:00

Firefox 3.5 for developers

It’s out today, and the feature list is huge. Highlights include HTML 5 drag ’n’ drop, audio and video elements, offline resources, downloadable fonts, text-shadow, CSS transforms with -moz-transform, localStorage, geolocation, web workers, trackpad swipe events, native JSON, cross-site HTTP requests, text API for canvas, defer attribute for the script element and TraceMonkey for better JS performance!

Tags: audio, browsers, canvas, crossdomain, csstransforms, dragndrop, firefox, firefox35, fonts, geolocation, html5, javascript, json, localstorage, mozilla, offlineresources, performance, textshadow, tracemonkey, video, webworkers

The March of Access Control

2008-11-19T08:40:34+00:00

The March of Access Control

The W3C Access Control specification is set to become a key technology in enabling secure cross-domain APIs within browsers, and since it addresses a legitimate security issue on the web I hope and expect it will be rolled out a lot faster than most other specs.

Tags: accesscontrol, browsers, crossdomain, internet-explorer, john-resig, security

CSSHttpRequest

2008-10-23T18:25:43+00:00

CSSHttpRequest

Devious cross-domain Ajax hack that uses CSS for transport (@import rules with data URIs, but it still works in IE). Similar to JSONP but safer, since JSONP can cause arbitrary JavaScript to execute.

Via Mike Migurski

Tags: ajax, atimport, crossdomain, css, csshttprequest, javascript, json, jsonp

window.name Transport

2008-07-23T16:25:51+00:00

window.name Transport

The cleverest use of the window.name messaging hack I’ve seen yet: Dojo now has dojox.io.windowName.send for safe, performant cross-domain messaging.

Tags: crossdomain, dojo, javascript, windowname

xssinterface

2008-03-05T00:08:12+00:00

xssinterface

Clever JavaScript library for implementing opt-in cross-domain messaging in JavaScript (allowing communication between pages and iframes on different domains). Uses HTML 5’s postMessage API if available, otherwise falls back on either Google Gears or a clever cookie hack.

Via Ajaxian

Tags: crossdomain, html5, javascript, postmessage, xssinterface

Cross-Site XMLHttpRequest

2008-01-09T23:57:00+00:00

Cross-Site XMLHttpRequest

“Firefox 3 implements the W3C Access Control working draft, which gives you the ability to do XMLHttpRequests to other web sites”—you can mark a document as available for cross-domain requests using either an Access-Control HTTP header or an XML processing instruction.

Via John Resig

Tags: accesscontrol, ajax, crossdomain, firefox, firefox3, http, javascript, john-resig, mozilla, w3c, xml, xmlhttprequest

hasAccount

2007-09-28T09:10:56+00:00

hasAccount

Stuart proposes a light-weight API for letting any site know if a user has an account (and is signed in) on another service. I wouldn’t want to deploy this without being confident that my CSRF protection was in order.

Tags: accounts, api, crossdomain, csrf, json, stuart-langridge

Google AJAX Feed API

2007-04-18T17:29:52+00:00

Google AJAX Feed API

Simple cross-domain proxy to allow JavaScript to access any publically addressable syndication feed, with the same logic as Google Reader providing normalisation.

Via Ajaxian

Tags: ajax, atom, crossdomain, feed, google, google-reader, javascript, rss, syndication

XMLHttpRequests using an IFrame Proxy

2006-08-01T17:40:02+00:00

XMLHttpRequests using an IFrame Proxy

Another scary hack abstracted away by Dojo.

Via dojo.foo

Tags: ajax, crossdomain, dojo, javascript, xmlhttprequest