Cross-site XMLHttpRequest The Future of Mashups? Urban Skudnik [email_address]

The Future of Mashups?

Urban Skudnik

[email_address]

Implementation We have all seen it We all love (or hate) it

We have all seen it

We all love (or hate) it

Old way - client-side xhr.open("GET", "/x/y/z"); xhr.onreadystatechange = function(){ // black magic} xhr.send()

xhr.open("GET", "/x/y/z");

xhr.onreadystatechange = function(){ // black magic}

xhr.send()

New way xhr.open("GET", " http://example.com /x/y/z "); xhr.onreadystatechange = function(){ // black magic} xhr.send()

xhr.open("GET", " http://example.com /x/y/z ");

xhr.onreadystatechange = function(){ // black magic}

xhr.send()

One more thing Server-side - a new header Access-Control &quot;allow <domain.data.com>&quot;

Server-side - a new header

Access-Control &quot;allow <domain.data.com>&quot;

More options allow deny allow <example.com> exclude <subd.example.com> allow <example.com> method GET, POST XML: <?access-control allow=&quot;example.org&quot;?>

allow

deny

allow <example.com> exclude <subd.example.com>

allow <example.com> method GET, POST

XML: <?access-control allow=&quot;example.org&quot;?>

Support Firefox 3 only :( Even FF3 support is buggy

Firefox 3 only :(

Even FF3 support is buggy

Bottom line Services distributed between domains - no need for ugly hacks No need for proxys allow <*> Not supported by IE, making it useless for the foreseeable future

Services distributed between domains - no need for ugly hacks

No need for proxys

allow <*>

Not supported by IE, making it useless for the foreseeable future