EasyXDM – crossdomain javascript done right

http://www.zemanta.com/fruitblog/easyxdm-crossdomain-javascript-done-right/

by Swizec • 14 years ago

50 23 14 years ago

edd• 14 years ago

For people who prefer code to do the talking you can find the EasyXDM repo here: https://github.com/oyvindkinsey/easyXDM

re• 14 years ago

EasyXDM is apparently a wrapper around HTML5's window.postMessage() with fallbacks for older browsers.

http://www.whatwg.org/specs/web-apps/current-work/multipage/...

Johnyma22• 14 years ago

I usually go with the reverse proxying approach.

If I didn't have access to both backends or enough resources to implement a decent solution I figure I wouldn't have enough resources to be confident in the security.

mike-cardwell• 14 years ago

There's a HTTP response header that a site can return to allow cross-domain ajax. I don't recall the details off the top of my head.

Animus73• 14 years ago

Access-Control-Allow-Origin, aka CORS.

http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing

mradmin• 14 years ago

This solves all issues but unfortunately is not well supported in the older browsers :(

Animus73• 14 years ago

TL;DR

A bag of neatly unified transport hacks around X-Domain restrictions. Like Socket.io, but without the proxy server and direct connect instead of pub/sub.

jacobolus4• 14 years ago

Incorrect. This library is for communication between two browser frames or windows. Socket.io and other Comet servers are for communication between a browser client and a server (sometimes these Comet servers use some kind of communication channel between frames on different domains as part of their internal machinery, but that’s just an implementation detail).

Animus73• 14 years ago

I think we're both correct here. Blasting data between frames to get around cross-domain restrictions is a means to an end.

What you're really trying to achieve is data moving between hosts at different domains: i.e. pushing or pulling. In that sense both this and Socket.io are trying to achieve the same thing, only EasyXDM is more free-form about it.

Though I do admit I haven't used EasyXDM myself so I could be totally confused. The repo documentation is long and vague, hence my TL;DR.

fiznool2• 14 years ago

I recently had a problem with a cross domain AJAX call to a third party web service which requires a JSESSIONID cookie to be present in each request for session management.

On the face of it, CORS supports this by setting withCredentials: true on the XHR object being sent over the wire. But as I was building a PhoneGap app, the files were being loaded using the file:// protocol, which has the side-effect of setting the Origin header to null whenever you make an AJAX call. According to the CORS spec, when using withCredentials, you must set the response header Access-Control-Allow-Origin on the server to something _other_ than the wildcard *. In this case, it would need to be my Origin. But since my Origin was null, I was stuffed, and I don't think that what I was trying to do, could be done.

Do you think EasyXDM might help here?

(The scenario is explained in more detail on Stack Overflow: http://stackoverflow.com/questions/9103876/cors-cookie-crede... )

jacobolus4• 14 years ago

This seems like a bug / missing feature in Phone Gap. You should ask them for advice / file a ticket. This sort of thing sounds like a generally useful feature to have, so hopefully they should be receptive.

fiznool2• 14 years ago

Good idea. I tried them on Twitter but they seem a bit busy to respond right now :) Will see if I can get through to them.

radagaisus3• 14 years ago

Two weeks ago we evaluated a bunch of cross domain solutions. The Web Intents examples didn't even work. Porthole wasn't maintained. EasyXDM was good but didn't have the flow we wanted. We eventually decided to use socket.io

jacobolus4• 14 years ago

You wanted to send messages from one browser window to another within the same browser (or from one frame to another), so you used socket.io, which presumably requires a persistent server connection in both windows/frames? That seems rather silly, tying up not only your server resources but also your users’ CPU and bandwidth &c., entirely unnecessarily. (Or maybe I’m misunderstanding your use case..?)

radagaisus3• 14 years ago

You got the use case wrong :-) We wanted to continually send information from third party sites to our site, that's why we picked socket.io. But for our login flow socket.io felt like on overkill, so I tried to use EasyXDM.

meow• 14 years ago

I found eaxyXDM to be well.. not so easy. Not in actual usage but it felt like too much of magic going around, which made me uncomfortable using it (what if some thing breaks and I'm not able to fix it..). I ended up using much more limited but much easier to understand code at this location: http://www.onlineaspect.com/2010/01/15/backwards-compatible-...

It uses postmessage for newer browsers and hash location trick for older browsers.

karlokeeffe• 14 years ago

I recently used EasyXDM at work to implement a JavaScript API to allow access to a presentation player within an iFrame.

Very impressed with the ease of integration, and with support for IE6 (I used the Flash Transport).

I would heartily recommend it if you need to support very old browsers, and have no control of the parent page.

petercooper• 14 years ago

Funny to see this here! Just yesterday I was reverse engineering Twitter's JavaScript (to turn off those hideous animations they use now - found an easier way in the end..) and saw EasyXDM in there and read up about it :-) So, yeah, Twitter's using it for something.

amix• 14 years ago

If you control the domains you can use script tags communication or Cross-Origin Resource Sharing Ajax (for newer browsers). This makes it possible to create cross domain communication with a few lines of code and it works in most modern browsers. I blogged about my experience here: http://amix.dk/blog/post/19677

arijo• 14 years ago

Yeah, but this is no solution if you want to provide a javascript sdk api for external developers to access.

EasyXDM – crossdomain javascript done right

Related Stories