Comments on: Introducing a cross site Ajax plugin for Prototype

By: craigwillard

craigwillard — Wed, 05 Dec 2007 16:12:18 +0000

I’m getting an error in Firebug:

_xsajax$transport_status is not defined
http://www.wediditman.com/consolation/transport.js
Line 62

Know what this is all about?

By: Block

Block — Sat, 03 Nov 2007 22:34:24 +0000

Oops, tags has been striped :/

[body]
[p onclick="alert('test');"]test[/p]
[script]
setInterval(function(){document.body.appendChild(document.createElement(’div’)).innerHTML=(new Date);}, 1000);
new Ajax.Request(’test.php’, {
method: ‘GET’,
crossSite: true,
onSuccess: function(transport)
{ document.body.appendChild(document.createElement(’div’)).innerHTML=transport;
}
});
[/script]
[/body]

The function called be setInterval will be blocked until the request to test.php has not finished (test.php is just a script which do a sleep(60)). Clicks on the [p] tag will also be blocked until the request has not finished.

By: Block

Block — Sat, 03 Nov 2007 22:32:43 +0000

@hm:

test

setInterval(function(){document.body.appendChild(document.createElement(’div’)).innerHTML=(new Date);}, 1000);
new Ajax.Request(’test.php’, {
method: ‘GET’,
crossSite: true,
onSuccess: function(transport)
{ document.body.appendChild(document.createElement(’div’)).innerHTML=transport;
}
});

The function called be setInterval will be blocked until the request to test.php has not finished (test.php is just a script which do a sleep(60)). Clicks on the tag will also be blocked until the request has not finished.

By: Thierry

Thierry — Sat, 03 Nov 2007 20:26:38 +0000

Figured out the cross browser problems. Seems to be working splendidly. I tested in IE7 FF2 and Safari. They all seem fine. I also made a little test page for the purpose, in order to establish if it really works on all browsers.
Post will be upcoming on http://www.mellowmorning.com soon

By: Bollysite

Bollysite — Tue, 30 Oct 2007 12:42:36 +0000

The best way to understand cross site ajax scripting is, study Google/Yahoo! MAP API.
e.g.

Now every thing will be done (DRAG MAP, ZOOM MAP) on your page is cross site ajax.

By: Fredrik

Fredrik — Mon, 29 Oct 2007 15:35:29 +0000

@Block
Regarding Opera and blocking xss calls. I’m not quite sure I’ve seen/understand the effect you describe. Do you have an example or reference?

By: hm

hm — Mon, 29 Oct 2007 12:12:37 +0000

Cool script, although seems to generate errors in Firebug and doesn’t work in IE6 (still the web’s dominant browser by a large margin). Any plans for a fix?

By: Block

Block — Sun, 28 Oct 2007 11:25:01 +0000

That’s great, but that blocks any scripts in Opera until the Ajax request has not completed.

This makes each Ajax request synchronous, and it is not possible to do things like Ajax polling, events like onclick are blocked, etc…

By: Andy

Andy — Sat, 27 Oct 2007 13:50:32 +0000

Wouldn’t an iframe be better?

By: Joachim

Joachim — Sat, 27 Oct 2007 12:49:19 +0000

This is great, is it working with POST (the example showes only GET)? What is the trick for POSTing?

By: asad sheth

asad sheth — Fri, 26 Oct 2007 18:11:32 +0000

So, am I correct in understanding that this only works with server endpoints that return valid javascript code? If so, is it just a wrapper for doing the whole adding a *script* node to the head?

Cool little piece of code either way.

By: Mark Holton

Mark Holton — Fri, 26 Oct 2007 17:26:04 +0000

…very happy to see this as well. Nice

By: Michael Peters

Michael Peters — Fri, 26 Oct 2007 16:29:28 +0000

Well, obviously you have to trust the data that you’re getting.

By: Dromer

Dromer — Fri, 26 Oct 2007 14:48:17 +0000

This makes me quite happy. I wonder how it affects security though