XML.orgXML.org
FOCUS AREAS |XML-DEV |XML.org DAILY NEWSLINK |REGISTRY |RESOURCES |ABOUT
OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.

 


Help: OASIS Mailing Lists Help | MarkMail Help

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index]
Re: [xml-dev] Maximally Consumable Data

Costello, Roger L. wrote:

> If the data is formatted as XML then Ajax is limited to fetching data
> from the same domain (website) that the Ajax application came from.

True.

> If the data is formatted as JSON then Ajax can travel across domains.
> That is, Ajax can access data from anywhere. Think of the power of
> this: a single Ajax application, running in your browser, can reach out
> and grab data from an unlimited number of web services, and present it
> in your browser in a coherent fashion. Awesome!
> 

Are you sure about this? Can you elaborate? Exactly how is this done, 
and why is this allowed? It sounds like a security hole waiting to happen.

Why are we allowing the browser to pull executable script code (JSON) 
from multiple domains but not allowing it to pull data (XML) from 
multiple domains?

-- 
Elliotte Rusty Harold  elharo@metalab.unc.edu
Java I/O 2nd Edition Just Published!
http://www.cafeaulait.org/books/javaio2/
http://www.amazon.com/exec/obidos/ISBN=0596527500/ref=nosim/cafeaulaitA/


[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index]


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 1993-2007 XML.org. This site is hosted by OASIS