Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #14045

Re: XMLHttpRequest

Followups directed to: comp.lang.javascript

Show key headers only | View raw

Tom de Neef wrote:

> With
>   asyncRequestor = new XMLHttpRequest();
>   asyncRequestor.onreadystatechange = processAsyncResponse;
> I communicate with a server in async mode.
> Event handlers will call this function with the appropriate arguments:
> 
> function informServer(callBackID,arguments) {
>   asyncRequestor.open("POST","/"+callBackID+"?"+arguments,true);

I am not sure it is such a clever idea to name a function parameter 
`arguments' when there is a built-in `arguments' object in the local 
execution context (ES 5.1, 10.6).

>   asyncRequestor.send(null)

Also, if a server accepts query parameters (only) in the URI of a POST 
request, and if a script allows to submit them verbatim, that is a potential 
security leak (URI length issues [0a] aside). [0b]

Usually, POST request parameters should go into the message body instead; as 
a result, a POST request's URI query part should almost always be empty, and 
its message body should *never* be empty (`null').  Therefore, a function 
allowing to submit a POST request should take an Array or Object of 
parameters, so that each parameter name and value can be checked, discarded 
or modified if invalid or potentially dangerous, and properly (URI-)escaped 
for the request.  (Of course, the same care has to be taken server-side; for 
example in server-side PHP, if you support POST requests, use $_POST, *not* 
$_REQUEST.)

> }
> 
> and the response is handled by the callback function:
> 
> function processAsyncResponse() {
>   var xml

You should append a semicolon here …

>   if ((asyncRequestor.readyState == 4) && asyncRequestor.responseXML)
>     {
>       xml = asyncRequestor.responseXML.firstChild;

… or declare and initialize the variable here.

>       if (xml) analyzeXmlResponseDoc(xml.firstChild)

Keep in mind that white-space text nodes – which may always occur in an XML 
document – are child nodes, too.  With XML documents, you would be well-
advised to access nodes directly, using XPath (evaluate()), 
getElementsByTagName(), and similar means.

>     }
> }
> 
> This worked fine until I hit situations where several events are triggered
> in rapid succession, such as onchange in a <select> and onclick on the
> page. What happens in that case? I found a reference where it says that an
> open() call will close requests still in progress but I can not find
> confirmation. I imagine that the script is run in a single thread,
> so how are successive calls to informServer handled by
> processAsyncResponse()?

Depends.  Implementations would likely vary, so you would do well not to get 
yourself into such a situation of race condition in the first place: Create 
and use a new object for each request; at the very least create and use a 
new object if there is a request in progress with the current one, i.e. the 
value of the `readyState' property is greater than 0 (uninitialized) and 
less than 4 (finished) [1].  jsx.net.http.Request() in JSX:http.js does just 
that [2]; however, optimizations are still possible.

Keep in mind that an HTTP client is supposed to limit the number of 
connections to the same server or proxy [3]; several HTTP clients in 
browsers do that [4]), so concurrent requests will very likely be queued.


PointedEars
___________
[0a] <http://stackoverflow.com/a/417184/855543>
[0b] 
<https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet>
[1] <http://msdn.microsoft.com/en-us/library/ie/ms534361(v=vs.85).aspx>
[2] 
<http://PointedEars.de/websvn/filedetails.php?repname=JSX&path=%2Ftrunk%2Fhttp.js&peg=242>
[3] <http://tools.ietf.org/html/rfc2616#section-8.1.4>
[4] 
<http://www.openajax.org/runtime/wiki/The_Two_HTTP_Connection_Limit_Issue>
-- 
When all you know is jQuery, every problem looks $(olvable).

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

XMLHttpRequest "Tom de Neef" <tdeneef@qolor.nl> - 2012-05-19 12:50 +0200
  Re: XMLHttpRequest Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-05-20 23:29 +0200
    Re: XMLHttpRequest "Tom de Neef" <tdeneef@qolor.nl> - 2012-05-21 09:45 +0200
  Re: XMLHttpRequest Scott Sauyet <scott.sauyet@gmail.com> - 2012-05-21 06:26 -0700
    Re: XMLHttpRequest "Tom de Neef" <tdeneef@qolor.nl> - 2012-05-21 16:05 +0200
      Re: XMLHttpRequest Scott Sauyet <scott.sauyet@gmail.com> - 2012-05-21 09:01 -0700
      Re: XMLHttpRequest Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2012-05-21 18:31 +0200
        Re: XMLHttpRequest Scott Sauyet <scott.sauyet@gmail.com> - 2012-05-21 12:42 -0700

csiph-web