Comments on: JSONRequest Extension for Firefox

By: Douglas Crockforrd

Douglas Crockforrd — Tue, 18 Sep 2007 15:59:33 +0000

I am strongly in favor of the JSONRequest. It is the right way to solve the problem. I dislike the XMLHttpRequest2 because it is confused about trust boundaries, and as we have repeatedly learned in the trenches, security is rarely obtained with confusion.

By: Erik Arvidsson

Erik Arvidsson — Tue, 18 Sep 2007 05:28:58 +0000

This is sad.

Doug and others agreed that JSONRequest was the wrong way to solve this problem. The right solution is to use XMLHttpRequest2 which is available in nightly builds of Firefox3.

http://www.w3.org/TR/access-control/
https://bugzilla.mozilla.org/show_bug.cgi?id=389508

By: Collin Jackson

Collin Jackson — Sat, 15 Sep 2007 21:35:39 +0000

I’ve released a new version of the JSONRequest extension (version 0.5) to handle the issue that Kris brought up.

By: Mark Holton

Mark Holton — Sat, 15 Sep 2007 04:41:07 +0000

Great news and great that this is getting coverage in the community… (thanks Ajaxians). … JSONRequest seems very like a very reasonable solution and straightforward to implement.

By: Biju

Biju — Sat, 15 Sep 2007 04:13:01 +0000

Why the code is not submitted as patch for bug 360666.

By: AndrÃ©s Testi

AndrÃ©s Testi — Fri, 14 Sep 2007 22:03:01 +0000

Good news! I hope JSONRequest become a de facto standard ;)

By: Collin Jackson

Collin Jackson — Fri, 14 Sep 2007 21:20:35 +0000

I’m following up with Kris offline to come up with a solution to the load timing issue.

Calvin, the short answer to your question is that JSONRequest lets you retrieve information across domains (unlike XMLHttpRequest) and safely (unlike the cross-domain script tag). For more information, see the JSONRequest proposal page.

By: Calvin Spealman

Calvin Spealman — Fri, 14 Sep 2007 20:39:10 +0000

I don’t get it. Why is this worth an extension when we can easily serialize and deserialize in JS already?

By: Kris Zyp

Kris Zyp — Fri, 14 Sep 2007 16:27:14 +0000

This is great news. With CrossSafe and this, we now have a native solution as well as a pure JS partial implementation of the JSONRequest. This is a great combination, because you could use CrossSafe, and it will automatically defer to native JSONRequest (like this) when available, otherwise it will do itself.
However, Colin, it appears that it behaves a little different than I expected, the JSONRequest object is not available until after the page is finished loading, so inline scripts can’t access JSONRequest immediately. Is there any reason for this? I would like to make sure CrossSafe works properly with your extension (properly defer to the plugin when available).