YOUR FEEDBACK
Immo Huneke wrote: A well written article, an ingenious solution to a real problem often encountere...
Cloud Computing Conference
March 30 - April 1, New York
Register Today and SAVE !..

SYS-CON.TV

2008 East
DIAMOND SPONSOR:
Data Direct
Frontiers in Data Access: The Coming Wave in Data Services
PLATINUM SPONSORS:
Red Hat
The Opening of Virtualization
Intel
Virtualization – Path to Predictive Enterprise
Green Hills
IT Security in a Hostile World
JBoss / freedom oss
Practical SOA Approach
GOLD SPONSORS:
Software AG
The Art & Science of SOA: How Governance Enables Adoption
PlateSpin
Effective Planning for Virtual Infrastructure Growth
Fujitsu
Automated Business Process Discovery & Virtualization Service
Ceedo
Workspace Virtualization
Click For 2007 West
Event Webcasts

2008 East
PLATINUM SPONSORS:
Appcelerator
Think Fast: Accelerate AJAX Development with Appcelerator
GOLD SPONSORS:
DreamFace Interactive
The Ultimate Framework for Creating Personalized Web 2.0 Mashups
ICEsoft
AJAX and Social Computing for the Enterprise
Kaazing
Enterprise Comet: Real–Time, Real–Time, or Real–Time Web 2.0?
Nexaweb
Now Playing: Desktop Apps in the Browser!
Sun
jMaki as an AJAX Mashup Framework
POWER PANELS:
The Business Value
of RIAs
What Lies Beyond AJAX?
KEYNOTES:
Douglas Crockford
Can We Fix the Web?
Anthony Franco
2008: The Year of the RIA
Click For 2007 Event Webcasts
TOP THREE LINKS YOU MUST CLICK ON


Cross-Domain JSON with Silverlight Avoids crossdomain.xml Restriction
One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX

Joshua Allen's Blog

One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX. The other day, I needed to mash up some JSON data from various sites, and found it pretty easy to use AJAX to circumvent the crossdomain.xml restriction.

Both Flash and Silverlight allow you to “mash up” data from other web sites, but only if that site has a crossdomain.xml policy file defined. This sucks if you are calling a service like FriendFeed, who can’t make up their mind.

If you’re doing pure AJAX, you can get around these cross-domain restrictions by using JSON. One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX. The other day, I needed to mash up some JSON data from various sites, and found it pretty easy to use AJAX to circumvent the crossdomain.xml restriction. In the next month or two, my team will release a simple library to make this generic, but in the meantime here is an explanation for anyone who is blocked:

Step 1: Call into JavaScript from Silverlight, passing the URL of the JSON API:

HtmlPage.Window.Invoke("injectScript", url);

Step 2: The JavaScript Function “injectScript” looks like this:

function injectScript(url) {

var head = document.getElementsByTagName(‘head’)[0];

var script = document.createElement(’script’);

script.type = ‘text/javascript’;

script.src = url;

head.appendChild(script);

};

Step 3: Have the JSON script call back to a function in your page called “callback”:

function callback(obj) {

var silverlight = document.getElementById("silverlight");

 

if (silverlight) {

silverlight.Content.Page.PassData(JSON.stringify(obj));

}

};

Step 4: The callback() JavaScript function passes the data into Silverlight, where it is loaded into a JsonObject:

[ScriptableMember]

public void PassData(string data)

{

JsonObject data = …

}

IMO, this code is cleaner and faster than the standard technique of creating a “WebRequest” from Silverlight. And of course, a WebRequest will fail if the crossdomain.xml is missing.

 

So, is this a security hole? No! All web browsers on the planet allow cross-domain access to JSON, and if JsonObject.Parse had a “url” parameter, we presumably wouldn’t need to check for crossdomain.xml. The current restrictions in Silverlight undoubtedly result from the fact that WebRequest doesn’t know whether its result is intended for Json, XML (which all web browsers restrict by default), or something else.

 

About Joshua Allen
Joshua Allen, an Evangelist at Microsoft, is also author of the "Better Life Through Software" blog.

YOUR FEEDBACK
Edgar wrote: Interesting article. I would like to point out that calling across browser domains will not work in all browsers. Firefox will outright prevent this behavior, and IE will alert the user with a warning. The best way to call into a service that you can't control is to make a call into your server, and then inside you server code forward that call onto the service onto the seperate domain. So the call flow would like something like this: Silverlight->ASP.NET Server->Service. Fortunately this is pretty easy to do.
Kyle Simpson wrote: Uhh, how exactly is this really at all different from flash and externalinterface? For instance, flash can easily make calls like: ExternalInterface.registerCallback("flcallback",handleResponse); ExternalInterface.call("injectScript", url); and the flash actionscript response handler: function handleResponse(str:String):void { // do something with the string } and of course the javascript for "injectScript" is the same. and the JS callback function: function callback(obj) { var fl = document.getElementById("myflash"); if (fl) { fl.flcallback(JSON.stringify(obj)); } } ---------------------------- I don't see how this is any functionally different? In fact, some parts of that I think are a bit more sensible than the SL version. And btw... this is really (IMHO) not a good idea to circumvent appropriate server-side authorization mechanisms...
LATEST AJAXWORLD RIA STORIES
Let’s face it - 2008 was a real slog. Even the most wide-eyed optimist would agree that this was one year whose end was long overdue. Of course, ringing in the New Year doesn’t somehow wash away what has become a fairly deep recession, but it does symbolize the fresh start th...
BonzoBox, a social homepage, has revealed its product to the public. The website has previously operated under a hidden beta only available to selected developers. BonzoBox is an interactive Web tool that allows people to build their own customized "BonzoBox" home page with live ...
Indigo Eight Software's release of AjaxPDF 2.5 lets thousands of DotNetNuke 4.x users view PDF documents in-line. Once installed, choose the PDF document to display, apply any of the optional security settings and the PDF document appears in-line within the Dot Net Nuke site. Thi...
Synology has announced the availability of its Disk Station Manager 2.1 beta which further utilizes AJAX technology, adds new mail server capability with 1-click installation Mail Station add-on, enhances the Synology Surveillance Station, storage management, user management, and...
rPath and WANdisco today announced that WANdisco has selected the rPath rBuilder and rPath Lifecycle Management Platform to build and maintain its Subversion MultiSite solution as a manageable set of application images for delivery in virtualized and cloud-based environments. rPa...
SUBSCRIBE TO THE WORLD'S MOST POWERFUL NEWSLETTERS
SUBSCRIBE TO OUR RSS FEEDS & GET YOUR SYS-CON NEWS LIVE!
Click to Add our RSS Feeds to the Service of Your Choice:
Google Reader or Homepage Add to My Yahoo! Subscribe with Bloglines Subscribe in NewsGator Online
myFeedster Add to My AOL Subscribe in Rojo Add 'Hugg' to Newsburst from CNET News.com Kinja Digest View Additional SYS-CON Feeds
Publish Your Article! Please send it to editorial(at)sys-con.com!

Advertise on this site! Contact advertising(at)sys-con.com! 201 802-3021

Click Here

SYS-CON FEATURED WHITEPAPERS

ADS BY GOOGLE