Question

Here’s the problem:

1.) We have page here… http://www.blah.com/mypage.html

2.) That page requests a js file http://www.foo.com like this…

<script type='text/javascript' src='http://www.foo.com/jsfile.js' /> 

3.) ‘jsfile.js’ uses Prototype to make an Ajax request back to http://www.foo.com.

4.) The ajax request calls http://www.foo.com/blah.html. The callback function gets the html response and throws it into a div.

This doesn’t seem to work though, I guess it is XSS. Is that correct?

If so, how can I solve this problem? Is there any other way to get my html from http://www.foo.com to http://www.blah.com on the client without using an iframe?

Answer 1

It is XSS and it is forbidden. You should really not do things that way.

If you really need to, make your AJAX code call the local code (PHP, ASP, whatever) on blah.com and make it behave like client and fetch whatever you need from foo.com and return that back to the client. If you use PHP, you can do this with fopen(‘www.foo.com/blah.html’, ‘r’) and then reading the contents as if it was a regular file.

Of course, allow_remote_url_fopen (or whatever it is called exactly) needs to be enabled in your php.ini.