Http GET from Aptana/Firefox

[kuhamobilen]

Hey

I am implementing a widget which will retrieve timetable infromation from a public third-party API (XML over Http GET). I started the development with IE 8 with no problems. Today I tried to run my code on Aptana / Firefox and my API requests stopped to work. Here is my code:

function test()
{
var url = "http://...;
xmlhttp = new XMLHttpRequest();
xmlhttp.open('GET', url, true);
xmlhttp.onreadystatechange = processResponse;
xmlhttp.send( null );
}

function processResponse()
{
if ( xmlhttp.readyState == 4 )
{
if ( xmlhttp.status == 200 )
{
result = xmlhttp.responseXML;
}
}
}

The code runs fine with IE but with Firefox, xmlhttp.status is always 0, xmlhttp.statusText is "OK" and xmlhttp.responseXML is null.

I can get the response returned by adding the following line

if ( window.netscape ) netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead UniversalBrowserWrite");

after the line where I create the XMLHttpRequest object. However, this does not sound like the way this issue should be tackled with.

Can somebody tell be why Firefox is behaving the way it is? Or even better, give me some hints on how to proceed?

Best Regards, kuhamobilen

[kuhamobilen]

I am adding some information here.

According to this site: https://developer.mozilla.org/En/HTTP_Access_Control the problem might be that the service API I am calling does not return the Access-Control-Allow-Origin attribute in headers.

"In response, the server sends back an Access-Control-Allow-Origin: header (...) In this case, the server responds with a Access-Control-Allow-Origin: * which means that the resource can be accessed by any domain in a cross-site manner. If the resource owners at http://bar.other wished to restrict access to the resource to be only from http://foo.example, they would send back: Access-Control-Allow-Origin: http://foo.example"

HTTP/1.1 200 OK
Date: Mon, 01 Dec 2008 00:23:53 GMT
Server: Apache/2.0.61
Access-Control-Allow-Origin: *
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/xml

The set of headers I receive is as follows:

Date: Sun, 14 Feb 2010 20:19:33 GMT
Server: Apache/2\nX-Powered-By: PHP/5.2.6-1+lenny4
Content-Length: 2958
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/xml

Do you think that the problem might be here? The response I receive lacks the Access-Control attribute.

[sivanand.jothy]

I face the same issue as well. Could someone help us out here?

[kuhamobilen]

Come on..please. Anybody?

I assume this is related to cross-site scripting. There must be a pattern to make call to public api services. Otherwise this widget stuff really doesn't make any sense.

[bduthoit]

You can see this : http://coderepos.org/share/browser/l...ScriptRequest/

But I'm not sure this would help. The service must respond JSON.

Another way is to call the webservice with a serveur between your widget and the webservice.

[kuhamobilen]

bduthoit,

Thank you for your kind response. I had already checked the site but unfortunately I don't see it fitting into my project.

I made some more tests. I copied the following url

http://rss.accuweather.com/rss/livew...|FI|FI007|OULU

from the AccuWidget sources and pasted it into my code. The code now looks as follows:

function test()
{
var url = "http://rss.accuweather.com/rss/liveweather_rss.asp?metric=1&locCode=EUR|FI|FI007|OULU";
xmlhttp = new XMLHttpRequest();
xmlhttp.open('GET', url, true);
xmlhttp.onreadystatechange = processResponse;
xmlhttp.send( null );
}

function processResponse()
{
if ( xmlhttp.readyState == 4 )
{
if ( xmlhttp.status == 200 )
{
result = xmlhttp.responseXML;
}
}
}

The result is that the code again works with IE8 but not with Firefox 3.6. This does not make any sence since you can run the AccuWidget on widget context! Sounds a bit weird to me.

Any comments/input to that? Thanks.

[isalento]

Hello,

This is indeed cross site scripting issue. The workaround for FF is the very same as you proposed in the fist post.
Desktop browser does not allow cross site request because of security issues. However WRT widgets are all about fetching data from remote sites and because that, no such restrictions are placed in WRT. Your widget will probably run fine on a real device.

try {	 
	netscape.security.PrivilegeManager.enablePrivilege('UniversalBrowserRead');	
} catch (e) {}

Br,
Ilkka