Try it out: get a random number from a script hosted on a foreign domain.
(Note: clicking repeatedly won't give you multiple results; you need to mouse out and mouse back in again. Please read How It Works to find out why.)
Your random number will appear here.
In certain edge cases, XMLHTTPRequest is impossible or unpalatable. It could be cross-domain security issues. It could also be that you've got a friendly script on the other end that supplies a JSON object with a callback, so you don't need to take the extra step of proxying it through a server on your domain.
Dynodes use CSS, unobtrusive Javascript, and the Document Object Model to create, import, run, and destroy foreign script nodes on demand, without the usual security restrictions faced by AJAX.
Please leave 'em in the Mindsack. Thanks!
onmousedown, onmouseover, and onmouseout events.loadScript, we insert the script node and change the class name to runScript.runScript, we run the function in the remote script that returns the data we want. Then we delete the script node and change the element's class name back to loadScript.runScript without clicking it, we delete the script node without calling the remote function. Then we change the element's class name back to loadScript, to await the next request.loadScript to runScript.I'm lucky enough to work with some of the leading voices in the field. One such alert reader is Douglas Crockford, who writes:
XMLHttpRequest suffers from a defective security mechanism that constrains it to connecting only with the server that delivered the base page. This renders XMLHttpRequest virtually useless for a large, exciting class of applications. Clearly an alternative is needed.
The dynamic <script> tag hack suffers from the opposite problem. It allows a page to access data from any server in the web, which is really useful. Unfortunately, the data is returned in the form of a script. That script can deliver the data, but it runs with the same authority as scripts on the base page, so it is able steal cookies or misuse the authorization of the user with the server. A rogue script can do destructive things to the relationship between the user and the base server.
It is safe in the particular example that Kent shows, but it is extremely dangerous in other patterns. Be extremely cautious in your own use, and even more cautious in teaching it outside. The unrestricted script tag hack is the last big security hole in browsers. It cannot be easily fixed because the whole advertising infrastructure depends on the hole. Be very cautious.
Thanks, Douglas. I thought twice about releasing dynodes into the wild; on balance, however, I believe that the technique is important enough--and working examples are few enough--that the benefits outweigh the risks.
That being said, I'm going to apply a really basic casual-bozo filter and not supply the source code for this example. If you know what you're doing with the Web, you know where to find it.
Article and code copyright © Kent Brewster, 2005. Please feel free to reprint or redistribute as long as you post a comment saying where you used it. Thanks!