Sharing structured data

XML Magazine

Subscribe to XML Magazine: eMailAlertsEmail Alerts newslettersWeekly Newsletters
Get XML Magazine: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


XML Authors: Jnan Dash, Jayaram Krishnaswamy, Jason Bloomberg, Chris Pollach, Peter Silva

Related Topics: RIA Developer's Journal, XML Magazine

RIA & Ajax: Article

Cross-Domain JSON with Silverlight Avoids crossdomain.xml Restriction

One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX

Joshua Allen's Blog

One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX. The other day, I needed to mash up some JSON data from various sites, and found it pretty easy to use AJAX to circumvent the crossdomain.xml restriction.

Both Flash and Silverlight allow you to “mash up” data from other web sites, but only if that site has a crossdomain.xml policy file defined. This sucks if you are calling a service like FriendFeed, who can’t make up their mind.

If you’re doing pure AJAX, you can get around these cross-domain restrictions by using JSON. One of Silverlight’s advantages over Flash is the relatively effortless interop with AJAX. The other day, I needed to mash up some JSON data from various sites, and found it pretty easy to use AJAX to circumvent the crossdomain.xml restriction. In the next month or two, my team will release a simple library to make this generic, but in the meantime here is an explanation for anyone who is blocked:

Step 1: Call into JavaScript from Silverlight, passing the URL of the JSON API:

HtmlPage.Window.Invoke("injectScript", url);

Step 2: The JavaScript Function “injectScript” looks like this:

function injectScript(url) {

var head = document.getElementsByTagName(‘head’)[0];

var script = document.createElement(’script’);

script.type = ‘text/javascript’;

script.src = url;

head.appendChild(script);

};

Step 3: Have the JSON script call back to a function in your page called “callback”:

function callback(obj) {

var silverlight = document.getElementById("silverlight");

 

if (silverlight) {

silverlight.Content.Page.PassData(JSON.stringify(obj));

}

};

Step 4: The callback() JavaScript function passes the data into Silverlight, where it is loaded into a JsonObject:

[ScriptableMember]

public void PassData(string data)

{

JsonObject data = …

}

IMO, this code is cleaner and faster than the standard technique of creating a “WebRequest” from Silverlight. And of course, a WebRequest will fail if the crossdomain.xml is missing.

 

So, is this a security hole? No! All web browsers on the planet allow cross-domain access to JSON, and if JsonObject.Parse had a “url” parameter, we presumably wouldn’t need to check for crossdomain.xml. The current restrictions in Silverlight undoubtedly result from the fact that WebRequest doesn’t know whether its result is intended for Json, XML (which all web browsers restrict by default), or something else.

 

More Stories By Joshua Allen

Joshua Allen, an Evangelist at Microsoft, is also author of the "Better Life Through Software" blog.

Comments (2)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.