Joshua Allen's Blog

One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX. The other day, I needed to mash up some JSON data from various sites, and found it pretty easy to use AJAX to circumvent the crossdomain.xml restriction.

Both Flash and Silverlight allow you to “mash up” data from other web sites, but only if that site has a crossdomain.xml policy file defined. This sucks if you are calling a service like FriendFeed, who can’t make up their mind.

If you’re doing pure AJAX, you can get around these cross-domain restrictions by using JSON. One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX. The other day, I needed to mash up some JSON data from various sites, and found it pretty easy to use AJAX to circumvent the crossdomain.xml restriction. In the next month or two, my team will release a simple library to make this generic, but in the meantime here is an explanation for anyone who is blocked:

Step 1: Call into JavaScript from Silverlight, passing the URL of the JSON API:

HtmlPage.Window.Invoke("injectScript", url);

Step 2: The JavaScript Function “injectScript” looks like this:

function injectScript(url) {

var head = document.getElementsByTagName(‘head’)[0];

var script = document.createElement(’script’);

script.type = ‘text/javascript’;

script.src = url;

head.appendChild(script);

};

Step 3: Have the JSON script call back to a function in your page called “callback”:

function callback(obj) {

var silverlight = document.getElementById("silverlight");

if (silverlight) {

silverlight.Content.Page.PassData(JSON.stringify(obj));

}

};

Step 4: The callback() JavaScript function passes the data into Silverlight, where it is loaded into a JsonObject:

[ScriptableMember]

public void PassData(string data)

{

JsonObject data = …

}

IMO, this code is cleaner and faster than the standard technique of creating a “WebRequest” from Silverlight. And of course, a WebRequest will fail if the crossdomain.xml is missing.

So, is this a security hole? No! All web browsers on the planet allow cross-domain access to JSON, and if JsonObject.Parse had a “url” parameter, we presumably wouldn’t need to check for crossdomain.xml. The current restrictions in Silverlight undoubtedly result from the fact that WebRequest doesn’t know whether its result is intended for Json, XML (which all web browsers restrict by default), or something else.