asked on

XMLHttpRequest in Safari/Dashboard/WebKit

According to Apple themselves, at this link http://developer.apple.com/internet/webcontent/xmlhttpreq.html (under Security Issues), the XMLHttpRequest object cannot be used to make cross-domain requests. However, I've seen tutorials like this http://www.oreillynet.com/pub/a/mac/2005/06/07/dashboard.html and actual working dashboard widgets like Twidget (http://www.frankmanno.com/widgets/twidget/) that use the object to call web services on another domain.

So, needless to say, I'm confused. Does Safari/Dashboard/WebKit somehow proxy the request? If I download Twidget and run it in Safari, it works fine, but if I run it in Firefox using Firebug, it gives me a Permission Denied error in the console when trying to make the XMLHttpRequest.

b0lsc0tt

I am not a Safari expert and right now it is pretty hard for me to get firsthand info on it or play with it. However I do know Javascript and the browser security issues you mention. A proxy could be one way around this but it is usually done with signed or "trusted" scripts. The browser, its security, and the way it uses Javascript affects this so a solution for Safari might not work the same way in IE, Firefox, Opera, etc. The location of the script and page (i.e. intranet, Internet, local) can also affect this. In other words the browsers will allow more things when the page and script are local or in an intranet than if it is an Internet webpage.

This should clear things up at least a bit. Let me know what additional info you need or what other questions you have. I can elaborate on most of what I mentioned so just need to let me know. If you want more info on signed scripts, etc then let me know.

bol

lukeinjax

ASKER

Well, I kind of suspected that there was something in Safari that allowed XMLHttpRequests from localhost, but I wasn't able to find anything on the web that says so. There isn't a whole lot of stuff out there on developing Dashboard widgets, and certainly nothing that I could find that went into the details about how/why XMLHttpRequests seem to work from Dashboard, but not from other hosts in Safari. Is there anything out there that can explain this a little better?

ASKER CERTIFIED SOLUTION

b0lsc0tt

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial