Meet Locrian
In one of my earliest posts here, I talked about a security restriction on Ajax that doesn't allow you to run XMLHTTPRequest on remote sites. Shortly thereafter, I ran a couple of tests and dismissed it.
Oops.
I finally ran into the restriction. I built a generic Ajax shell, and while it works on a local site, it doesn't work on a remote one. I don't know why it worked in my initial tests, but for whatever reason, it did then and doesn't now. Unfortunately, that kinds of destroys the entire technological basis for what I wanted to do.
But there are other ways to do this, and some are just as good. The one I've come up with is called Locrian. (Hopefully, it's a little better behaved than its namesake...) The premise is similar to how bookmarklets themselves work--you just attach a new script object to the DOM tree, give it a source, and the page heads off to find it. Instead of just loading a javascript, though, you can also pass get variables to whatever page you define as the source, process them, and then output the result in the javascript that gets loaded into the new script object. It's sort of Ajax without the middleman of XML. I also built in a function that takes care of the annoying problem where you have to manage all of your Javascript includes in html; with Locrian, you just include it in the html, and then you can add all the JS includes you want in JS itself (the generic Ajax shell I wrote has this ability, too.)
There are restrictions, though; it is the lesser Ajax, after all. It's limited to get variables, which means that the total length of the URL can't be more than 2048 characters (thanks, Microsoft!) You can't send binary data, either. What this means is that I'll be using Locrian to handle all functions on Re:Poste other than the inputting of text comments. For that, I'll be using a form that refreshes the page...but really, that makes sense anyways, since if you do text input you probably want more feedback than just having it disappear off into the ether when you hit a button. The other functions are mostly just ratings buttons, etc., and don't need that level of feedback.
To see how it works, look at the files in this zip.
posted by John @ 10:35 PM
1 comments
1 Comments:
Wow--this is a really interesting approach, and seems a clever way to integrate some of the features you've been hoping to work with for some time now.
All in all it sounds exciting and I look forward to seeing it in action. Till then, some questions to ponder:
* Am I right to assume that you're not using XMLHttpRequest? It sounds like you're sort of building a version of databuffer that uses script includes in place of the hidden iframe (along with a script "manager" to keep track of things). Is that a fair characterization (haven't looked at the zip)?
* Maybe the GET limitation is sufficient to prevent major misuse, but if I were a paranoid I'd be wondering what sort of vulnerabilities this strategy could introduce for a Web surfer. I suppose the remote site doesn't learn anything about you that you don't already hand over to the site in view. A phishing scam based on bookmarklets would only work on the most gullible, but I'm wondering if the same script-inclusion technique could be used with a redirect to an authentic site (thereby reporting back to a malicious site).
My concern here is less that you'd unleash a wave of online fraud--you haven't done anything that JavaScript doesn't already make possible--but that some paranoid Firefox developer might add a warning message and/or blocking preference when such activity is detected.
* Locrian is a cool name--sounds like BloodRayne's sidekick--but the mythological character's, um, character leaves a lot to be desired. Cassandra is a heroine to many feminists and counterculturalists; I can just see the critique of Locrian "raping" data from foreign Web sites. Two other semi-random options, assuming we're working in the namespace of Homeric esoterica:
1. Telamonian. The "greater" Ajax was also known as the Telamonian Aias, Aias being a different transliteration of the Greek "Ajax". (Telamon was his dad.)
2. Patroclus. His name doesn't have a ring to it like Locrian, but Patroklos (Latin Patroclus) was a hero whose body Ajax (AKA the Telamonian Aias) helped retrieve from a remote (Trojan) battlefield. More significantly for the Greeks, Patroclus was best buddy to Achilles, the only Greek warrior superior to his cousin Ajax. (Why not pick "Achilles" then, you ask? Because it's braggardly and fails to reveal the depths of your interest in arcane antiquity!) Patroclus' death also inspired the Olympics. All of which has about as much to do with JavaScript and remote scripting as, well, the original name Ajax :)
* Now you really have to get Novomancy/Code Pool/Whatsis up and running!
jon
Post a Comment
<< Home