Comments on: Using window.name transport for cross-site POST scripting

By: George Georgovassilis

George Georgovassilis — Mon, 07 Jun 2010 10:12:03 +0000

Nice post Alex!

I noticed that history management in IE and Safari is affected by this technique. IE will cooperate if you use contentWindow.location.replace instead of directly assigning the old domain URL to it. Safari will insist on creating a new history entry for each form submission

By: Sean Kinsey

Sean Kinsey — Wed, 24 Jun 2009 17:34:17 +0000

There is now a new library available, easyXSS, at http://code.google.com/p/easyxss that in very few lines enables you to send data and call methods across the domain boundry.

Take a look!

By: Alex Moffat

Alex Moffat — Mon, 15 Jun 2009 14:58:06 +0000

Unfortunately I don’t know the answer. Ray Cromwell could probably give you a more useful response. I see from the thread that it works in IE6 so my first thought, that it’s targeting the iframe instead of the window, doesn’t seem likely.

By: chris

chris — Mon, 15 Jun 2009 03:23:46 +0000

Do you know if this works with GWT 1.6? I can get the POST to make the post call to a secondary domain.

I can not seem to get the POST results back into any usable state. I see the response back in FF using firebug; however, the window.name always returns the iframe name set by GWT, which is an incremented name like “FormPanel_XX”.

I’m trying to get a simple sample working and any pointers would be much appreciated. Here is a thread with a full description of what I am trying: http://groups.google.com/group/Google-Web-Toolkit/browse_frm/thread/139a99baf2382340#

Hopefully it is something simple that I have overlooked on my part.

Thanks,
Chris….

By: Alex Moffat

Alex Moffat — Mon, 30 Mar 2009 02:42:25 +0000

@Ray Thanks. That would be an interesting hack. I’d need a motivating example before I tried to tackle it though

@Rajesh It might be possible. The thing is though, to get cross site posting to work you need the cooperation of the server, it’s got to be returning a script that sets window.name. If you have enough control to get it to do that I would think it would be easier to just provide the same functionality via a GET method. Cross site file upload would require the POST technique I think but why not try to do everything else with GET which lets you use the much simpler script technique with JSONP. Server cooperation is still needed but the client side is perhaps more easily understood.

By: Rajesh

Rajesh — Sat, 28 Mar 2009 09:42:11 +0000

Great solution. Do you think it is possible to have a method like

crosspost(url,callback,jsonData)

Is there any easy way to convert JSON object into form? Or some other way to make it work with above solution?

I want to export an API for end users who don’t have to deal with all the complexity involved in above solution.

By: Ray Cromwell

Ray Cromwell — Thu, 26 Mar 2009 19:26:02 +0000

Hey Alex, great write-up, and a better explanation than mine! A cool hack to do would be to modify the ServiceInterfaceGeneratorProxy/ProxyGenerator and RemoteServiceProxy class to use this technique instead of XHR, and create a subclass of RemoteServiceServlet to deal with incoming RPC that wants the output as a window.name assignment.