Path: csiph.com!usenet.pasdenom.info!goblin2!goblin.stu.neva.ru!xlned.com!feeder1.xlned.com!npeer.de.kpn-eurorings.net!npeer-ng0.de.kpn-eurorings.net!newsfeed.arcor.de!newsspool2.arcor-online.net!news.arcor.de.POSTED!not-for-mail Content-Type: text/plain; charset="UTF-8" Message-ID: <1870325.DxoWjsJ0Ul@PointedEars.de> From: Thomas 'PointedEars' Lahn Reply-To: Thomas 'PointedEars' Lahn Organization: PointedEars Software (PES) Date: Sat, 10 Nov 2012 20:50:51 +0100 User-Agent: KNode/4.4.11 Content-Transfer-Encoding: 8Bit X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&. <2261899.gBobAo4G4S@PointedEars.de> <4265d7df-81e2-4c58-a16d-cafc435a1e88@j19g2000vba.googlegroups.com> <28208070.qZZrvzLHK0@PointedEars.de> <4351338.UcPtXxdYxD@PointedEars.de> Followup-To: comp.lang.javascript MIME-Version: 1.0 Lines: 43 NNTP-Posting-Date: 10 Nov 2012 20:50:53 CET NNTP-Posting-Host: b0e98bac.newsspool2.arcor-online.net X-Trace: DXC=4H]E[WDDAgKWDmlTRbh@=IA9EHlD;3YcB4Fo<]lROoRA8kFK@?H3jTVH[5eD^oD W dniu 2012-11-10 13:55, Thomas 'PointedEars' Lahn pisze: >> Cezary Tomczyk wrote: >>> W dniu 2012-11-10 11:36, Thomas 'PointedEars' Lahn pisze: >>>> Asen Bozhilov wrote: >>>>> Obviously the JSON string comes from your server, otherwise the AJAX >>>>> call would fail to fetch the string duo to cross domain policy. >>>> >>>> First of all, it is the Same Origin Policy (SOP; *origin*, i. e. >>>> protocol, host, and port number must match). That aside, this argument >>>> is no longer sound. XHR can be made cross-domain if the target domain >>>> allows it. >>>> >>>> >>> >>> While CORS (Cross-Origin Resource Sharing) is implemented in most >>> browsers then IE8 and IE9 do not support it. Source: >>> http://caniuse.com/#search=cors > […] >>> The workaround is to use iframe for them, right? >> >> Not necessarily. > > Well, then what to use for IE7? When not iframe. You can use a transparent proxy with or without a JSONP-like approach for cross-domain requests in all user agents that would parse the content of new `script' elements, including Internet Explorer before version 10 (perhaps down to version 4 inclusive; proper tests are pending), without iframes. The advantage of JSONP is that you can be sure the data is loaded when the callback is called. BTW, iframe cross-domain scripting requires a proper `X-Frame-Options' response header field value in case document.domain is not applicable. PointedEars -- > If you get a bunch of authors […] that state the same "best practices" > in any programming language, then you can bet who is wrong or right... Not with javascript. Nonsense propagates like wildfire in this field. -- Richard Cornford, comp.lang.javascript, 2011-11-14