| Page 1 of 1 | [ 9 posts ] |
|
I am trying to rewrite some old javascript code into yui3.
I am trying to post data from a form to another page in another domain. My original javascript var xmlHttpReq = false; var self = this; // get the xml http object if (window.XMLHttpRequest) self.xmlHttpReq = new XMLHttpRequest(); // Mozilla/Safari/Ie7 else if (window.ActiveXObject) self.xmlHttpReq = new ActiveXObject("Microsoft.XMLHTTP"); // older IE // create the request self.xmlHttpReq.open('POST', strURL, false); self.xmlHttpReq.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); self.xmlHttpReq.onreadystatechange = function() { if (self.xmlHttpReq.readyState == 4) updatepage(self.xmlHttpReq.responseText, responsediv); else updatepage(responsemsg,responsediv); } // send the request var txt = getquerystring(formname); self.xmlHttpReq.send(txt); here is my yui3 code YUI().use('node', 'event', 'io', 'io-xdr', function (Y) { var div_res = Y.one("#MyResult"); div_res.setContent("submit"); //Configure the cross-domain transport: var xdrConfig = { id:'flash', src:'io.swf' }; Y.io.transport(xdrConfig); function post_success(id, o) { alert('success'); } function post_failure(id, o) { alert('failure'); div_res.setContent(o.status + " " + o.statusText); } Y.one("#Submit1").on("click", function (e) { var sUrl = "http://anotherdomain.com/page.php"; var req = Y.io(sUrl, { method: 'POST', sync: true, xdr: { use:'flash' }, headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, form: { id: 'myform' }, on: { success:post_success, failure:post_failure } }); e.preventDefault(); e.stopPropagation(); }); } I am getting a security violation on the yui3 code. I am a newbie to both yui and ajax. Am I doing anything wrong? What am i missing? |
Allen RabinovichYUI Developer
|
What type of security violation are you getting? If you are using flash as a transport, the target domain needs to have a crossdomain.xml file that looks something like this: http://weather.yahooapis.com/crossdomain.xml (the allowed domains can be modified depending on how you want to limit access, but should include at least the domain where io.swf is hosted).
|
|
I don't know, the reply message just says 0 Security Violation
I don't know if i even need to use flash for this either. I am just mimicking a form submit to a page on another domain. How can i tell what else i need to do? The code on the top worked in firefox, but not in ie. I just need to get it working in both. |
Allen RabinovichYUI Developer
|
Just so I better understand the problem: at what point does the security violation occur? Does the success event ever fire, or failure? I am trying to figure out if the security violation is something that the server is reporting, or something that occurs entirely because of browser security restrictions.
Is it possible for you to post the code somewhere with the actual URL of the server you are submitting the data to, so I can try to observe the error? |
|
The failure event fires, and it is the one that displays the message.
The error is probably that the remote server does not allow cross domain postings. But that leaves the issue, i would like to do the same thing as a form submit button would do ( i even have the form ). But the form action points to a remote server. ( if i press a submit button on the form it works just fine ) Do i need cross domain flash to do that? I personally don't think so ( if form.submit does it, why can't i just do the same thing in javascript/ajax.) maybe i am way off base here and my newbie status is showing. As far as posting the url i would rather not. It will need some private fields for it to work anyway. |
Allen RabinovichYUI Developer
|
The security demands from a form posting and a same-page data submission are different. Think of it this way: when you submit a regular HTTP form, the page that it was submitted from cannot get the results back -- the results come back directly to the user. So the security of that data is never compromised, even if the form is submitted by a malicious entity. With a crossdomain same-page submission, however, the page that submits the data gets the results back, and thus the target server must give explicit permission to the submitting page to do so.
So, yes, you will need the crossdomain.xml file in the root of your server to accomplish this. Try using the same one as here: http://weather.yahooapis.com/crossdomain.xml and see if it fixes your security violation. Then change the 'domain' attribute of the allow-access-from property to the domain that's hosting io.swf (that's more secure than '*', although you still need to ensure that that domain cannot host a page that might have malicious intents), and see if it continues to work. |
Allen RabinovichYUI Developer
|
Just to clarify, the crossdomain.xml needs to be in the root of the server receiving the form submission. So you should have:
mydomain.com/io.swf <-- where your io.swf is hosted anotherdomain.com/crossdomain.xml <-- anotherdomain.com/someurl.php is where your request is being sent, and crossdomain.xml would contain <allow-access-from domain="mydomain.com"> |
|
I guess there is the problem. I don't have any control over the foreign site.
I really don't care about any return data at all. ( other than it was sent or not ) Is there any way to fake a normal form submission? |
Allen RabinovichYUI Developer
|
You can load the foreign site with the appropriate GET variables in a hidden iframe. You won't be able to access the content returned for security reasons, so unfortunately you won't know if the submission was successful.
Another possible way to do that is via your own server-side proxy. That may have other security implications, so tread carefully. |
| Page 1 of 1 | [ 9 posts ] |
| You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum |
© 2006-2013 Yahoo! Inc. All rights reserved.
All code on this site is licensed under the BSD License unless stated otherwise.
About This Site · Security Contact Info
Powered by phpBB® Forum Software © phpBB Group