Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm embedding an application via iframe into a someones site and need to be able to call a few of their javascript functions. Clearly running a top.cart.add() gets blocked by the same-origin policy. We've exhausted most of our options when it comes to getting them to set something up for us, so we need to try to work around them. Someone mentioned that having them set up a CNAME record could allow us to execute cross domain javascript. Is that possible? If so, how does that work. If not, how would you recommend I approach this?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Yes, a cname would work. The simple reason is that the browser/java will use the host directive, which is obtained from the hostame entered in the address bar, or specified in the code of the webpage when it pulls up additional objects.

The way cname works, is it responds to requests for host1.domain1.com and responds with another dns name, say host2.otherdomain.com, which is queried by the resolver. This is all done by the resolver, and is separate from what is going on with app/browser, so it's "transparent" (For lack of a better descriptive word right now).

if the webpage is at www.foo.com, but your app is from www.bar.com, you can ask them to create a cname for bar.foo.com or something, that points to www.bar.com. The only other thing you need to then do is create a vhost on your webserver that listens for foo.bar.com as well as www.bar.com - if you are using vhosts.

share|improve this answer
    
Great answer. Thanks for the explanation –  Brad Herman Apr 14 '11 at 14:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.