Home/ Questions/Q 6720457
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T09:12:52+00:00

I am writing a REST service that is to be accessed by web applications,

  • 0

I am writing a REST service that is to be accessed by web applications, desktop clients, mobile clients etc. via a REST interface. The idea is to store objects like notes, calendar events etc. in a common hierarchy and to provide HTTP methods for creating, updating and deleting documents, so this should be the ideal scope for a REST interface.

My plan is to have a REST server somewhere and web applications other servers using the data, so I need to make cross-domain request which are under special restrictions for security reasons (see e.g. this article). I also want to do some real-time updating web stuff.

Now I have been doing extensive research, learning what CORS is and trying it out (with tornado and jQuery.ajax), but by now, I’m getting the suspicion the setup I’m aiming is simply coming to soon. I only tried with Firefox (both 3.6 and 9), but I’m already having problems:

  • HTTP authentication does not to work with jQuery.ajax() (even if withCredentials is set)
  • some browsers do not support CORS at all (says Wikipedia)
  • at least one FF plugin (RequestPolicy) makes CORS not work at all

I understand that CORS/AJAX is a possible solution, but there seem to exist too many restrictions for a practical use. What do you people who did this kind of thing before think: is this something I should just do and hope these problems will be solved by someone sometime in the future? Or is just too soon for the cross-domain REST/AJAX approach? What alternative would you choose for the above plans? As I am starting a new project, I would like to do it clean, without JSONP, proxies or other work-arounds, but if there’s no way around, I’d do that anyway.

Thanks for any answers!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    There is nothing stopping you providing responses in standard JSON (e.g. for instances where CORS is available in the browser), and in JSONP in the cases it isn’t. It won’t affect anything but your output.

    I would not say CORS is viable by itself as IE < 8 does not support it. I would also say that there is nothing wrong with JSONP; it is a technology utilized by major players (Facebook API, Twitter API, Flickr API, Google’s various API’s).

    In short, what you said is correct; CORS is not adopted widely enough at this time to be used.

    • 0