Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web-page on my domain (ecmazing.com), and I'd like to be able to send AJAX requests to this URL:

http://hacheck.tel.fer.hr/xml.pl

It's a Perl script that is located on a different domain (and it returns an XML response).

The "Same origin policy" doesn't allow for Ajax communication from a web-page on my domain.

Now, I've heard about CORS, and I think that it could solve my issue. If I understand correctly, the admin of the hacheck.tel.fer.hr domain would have to configure the web-server so that Ajax requests from my domain (ecmazing.com) would be permitted.

Could you tell my what actions specifically the admin would have to perform? I'm going to contact him so I'd like to be able to give him the specifics...

CORS spec is here: http://www.w3.org/TR/cors/

Info about CORS is here: http://www.w3.org/wiki/CORS_Enabled

share|improve this question

3 Answers 3

According to the link you sent it's enabled by defualt and only needs a .htaccess file change presuming it's apache:

To expose the header, you can add the following line inside <Directory>, <Location>, and <Files> sections, or within an .htaccess file.

 <IfModule mod_headers.c>
   Header set Access-Control-Allow-Origin "*"
 </IfModule>

I can say that as an admin you had better be well prepared to justify why this can't be done in code rather than on the server and why I should allow you to do this.

share|improve this answer
    
@Jim The domain that hosts the Perl script is owned by my college. I'm doing a proposal for a web-page (service) as my thesis, so I expect full support from my college. In order to demonstrate my proposal online, I need to be able to communicate with that Perl script. I currently see two solutions: (1) CORS, (2) host my proposal on the domain of the Perl script (but in that case I'd have to have a FTP account so that I can update my page at any time), and I'm not sure if my college can set up such a FTP account for me... –  Šime Vidas Jun 2 '11 at 18:51
    
@Sime (apologies I cannot determine how to enter the diacritic char. of your name) I understand you expect support, however if you wrote a paper on bank robberies would you expect the college to help you rob one? Client side scripts are blocked from this behavior for a whole host of reasons. Even Ben's jsonp suggestion has an effort to close that loophole. As an admin, telling me I have to render all sites vulnerable to this sort of issue to support your effort wouldn't get much traction. In my opinion you would get better results and more support by asking for the FTP account. –  Jim B Jun 3 '11 at 12:33
    
@Jim Using CORS does not implicitly enable all scripts on the internet to access your server files. You (on the server-side) can use CORS to specify which domains get access. In my particular case, I'd like scripts from my domain (ecmazing.com) to be able to access files (via Ajax) from the domain hacheck.tel.fer.hr (which is, note, not the main domain of my college, but a sub-sub-domain of it). Since this domain only hosts the server-side code for the Hacheck application (and no other sensitive data), I believe the admin of that domain should be able to grant me access (temporarily)... –  Šime Vidas Jun 3 '11 at 12:54
    
@sime according to the docs it looks like you have to allow all sites, in the security doc (code.google.com/p/html5security/wiki/CrossOriginRequestSecurity) is specificlly mentions that security is in the hands of the developers - not the admins. If the HAcheck application isn't critical or sensitive and it's the only site on the server then certainly I'd be more open to modifying htaccess. –  Jim B Jun 3 '11 at 13:09
    
@Jim No, there is the Access-Control-Allow-Origin HTTP response header which controls which domains have access. Only if you set the value of this header to * (wildcard), only then will all scripts on the Internet have access to your pages. More info is in the page you linked under "Universal allow" onwards. –  Šime Vidas Jun 3 '11 at 13:46

You might want to consider Cross-Domain JSONP. From the Wiki: "'JSON with padding' is a complement to the base JSON data format, a pattern of usage that allows a page to request data from a server in a different domain. As a solution to this problem, JSONP is an alternative to a more recent method called Cross-Origin Resource Sharing."

I've started using this for several remote API's without any issues, it's great :)

share|improve this answer
    
I would love to use JSONP. However, the Perl script returns an XML response, and I am the client-side programmer (the Perl script is on the server-side). I don't think that I would be able to persuade the server-side programmer to rewrite the Perl script.... –  Šime Vidas Jun 2 '11 at 17:50

We're maintaining enable-cors.org for answering this kind of questions. If you want to share new recipes for configurations, pelase raise an issue.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.