I am writing an HTML5 application that is gathering data from a few different sources using JSONP. Anything I’m doing with a GET works perfectly. I’m now trying to POST data, and I’ve run into an interesting snag. I need to POST data from my application to another, where my application is running from a local machine. I am trying to write a cross-platform capable mobile application (think Pulse/Flipboard), so the code will always be running from a local source. My thought process was as follows:
- Use JSONP – JSONP does not allow for posting, it just doesn’t work that way (Post data to JsonP)
- Rely on CORS – Since the request is coming from a local source using
file://, the origin header is null. This causes the request to fail (XmlHttpRequest error: Origin null is not allowed by Access-Control-Allow-Origin) - Use another server to bounce the request off of – this would be expensive
All of the browsers I’m targeting are webkit based (iPad, Playbook, Android), so I’m wondering if there are any creaks in the same origin policy code that I can sneak through? Maybe something using iframe or postMessage?
As it would turn out, the easiest way to do this is to post to the target url inside of an iframe. Same origin policy on most browsers allows you to perform an HTTP POST from one domain to another unrelated domain. I solved the problem by adding an iframe to my page, initially set to a local bootstrapping page. Since that page was loaded from the same domain, I am able to control it via script. I used that to post the form to my target site, and polled the results to determine if my call was successful. It’s not elegant, but it works.