On Fri, Jul 17, 2009 at 10:53 AM, Gene Amtower<[email protected]> wrote:
> Jonathan and Karthik,
>
> While there are circumstances where you can't make cross-domain web
requests
> due to security constraints (some POST requests come to mind), there are
> other situations where it is allowed. In fact, the RPC implementation in
> Qooxdoo allows for some cross-domain calls if the server itself is set to
> allow them, although it's not a good idea. However, from what I remember
> and without going and looking at the Qooxdoo docs, I thought that the
> HttpRequest was a standard GET request that can request content from any
> server, regardless of matching domain. Am I remembering this incorrectly?
Nope. In qooxdoo we provide multiple "transports". Each transport has a set
of capabilities that it supports. Based on the user-requested capabilities,
an appropriate transport is selected.
The capability list includes:
- synchronous
- asynchronous
- crossDomain
- fileUpload
- programaticFormFields
- responseTypes
Each of these has a corresponding property in the Request object, e.g.,
request.setAsynchronous(true) turns off a request for the 'synchronous'
capability and turns on a request for the 'asynchronous' capability.
The three provided transports support these capabilities, are used with the
following precedence:
1. XmlHttp
synchronous : true,
asynchronous : true,
crossDomain : false,
fileUpload : false,
programaticFormFields : false,
responseTypes : [ "text/plain", "text/javascript",
"application/json", "application/xml", "text/html" ]
2. Iframe
synchronous : false,
asynchronous : true,
crossDomain : false,
fileUpload : true,
programaticFormFields : true,
responseTypes : [ "text/plain", "text/javascript",
"application/json", "application/xml", "text/html" ]
3. Script
synchronous : false,
asynchronous : true,
crossDomain : true,
fileUpload : false,
programaticFormFields : false,
responseTypes : [ "text/plain", "text/javascript",
"application/json" ]
As you can see, the only one that supports crossDomain is the Script
transport, which doesn't do GET or POST or anything like it. Rather, it
creates a <script> tag and expects a response that calls the qooxdoo
function qx.io.remote.transport.Script.requestFinished(). The the primrary
RPC backends all support this transport, although it must be explicitly
enabled since it's dangerous.
Cheers,
Derrell
------------------------------------------------------------------------------
Enter the BlackBerry Developer Challenge
This is your chance to win up to $100,000 in prizes! For a limited time,
vendors submitting new applications to BlackBerry App World(TM) will have
the opportunity to enter the BlackBerry Developer Challenge. See full prize
details at: http://p.sf.net/sfu/Challenge
_______________________________________________
qooxdoo-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/qooxdoo-devel
