Friday, February 23, 2007

Ajax Cross-Domain Issue

A common solution to the XMLHttpRequest cross-domain issue (aka cross site scripting or XSS), where you can only communicate with the originating domain, is to configure Apache to use either mod_proxy or mod_rewrite for URL rewriting and a pass-through proxy.

With Apache you need to enable the proxy functions (configure --enable-proxy). If you want to handle it all with mod_proxy, then define you proxy settings in httpd.conf such as:

ProxyPass /doExt
ProxyPassReverse /doExt

If you want to use mod_rewrite then turn on mod_rewrite in httpd.conf or .htaccess with RewriteEngine on and define your rewriting rules such as:

RewriteRule ^/doExt$ [P]

Then when you post to your server via /doExt, Apache will pass the request on to the external site.

That's all well and good if you have access to the Apache configuration or the server is already configured with the proper modules. But, when your on a hosted environment, that's not always feasible. Another solution would be to provide a proxy servlet to make the remote request for you and return the result. What I am providing is in Java and PHP, but it could be written you language of choice.

Java proxy

The following servlet class will invoke some external URL on behalf of the original request and return the result from the external request as the result of the original local request. Note: In the following code I hard-coded the real destination. However, it could be determined from a parameter in the original request just as easily.

import java.util.Enumeration;

* This is a simply proxy class in order to bypass AJAX security contraints.

public class ServerProxy extends javax.servlet.http.HttpServlet {

private static final long serialVersionUID = 1L;

public void doGet(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
throws javax.servlet.ServletException, {
performTask(request, response);

public void doPost(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
throws javax.servlet.ServletException, {
performTask(request, response);

public void performTask(javax.servlet.http.HttpServletRequest request,
javax.servlet.http.HttpServletResponse response)
throws javax.servlet.ServletException, {

// Get the external URL to invoke
String realUrl = "";

// Copy the request parameters from the original request
Enumeration paramNames = request.getParameterNames();
String paramName;
while (paramNames.hasMoreElements()) {
paramName = (String) paramNames.nextElement();
realUrl = realUrl.concat(paramName + "="
+ request.getParameter(paramName));
if (paramNames.hasMoreElements()) {
realUrl = realUrl.concat("&");

// real URL will be returning XML data
PrintWriter out = response.getWriter();

// invoke the real URL and copy the result into the response
// for the original request
URL real = new URL(realUrl);
BufferedReader in = new BufferedReader(
new InputStreamReader(real.openStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)



PHP proxy

Here is a similar solution using PHP:

$remoteServer = "";
$path = $_GET[”path”];
$proxyTarget = $remoteServer.$path;
$connection = curl_init($proxyTarget);
curl_setopt($connection, CURLOPT_HEADER, false);
curl_setopt($connection, CURLOPT_RETURNTRANSFER, true);
$data = curl_exec($connection);
header(”Content-Type: text/xml”);
echo $data;


Vineet said...

Solve XMLHttpRequest cross browser issue using Google gadget

I have found one solution for cross-domain problem.

I have a youtube player which gets RSS feed from But I have hosted the page at
Earlier I had web proxy which got data from youtube which was then converted into JSON and then fed to the javascript in webpages on googlepages.

Well now I converted my javascript to Google Gadget, this will give your webpage an access to Google's javascript library, this library will fetch any site via web proxy. In summary if you use Google gadget code you can circumvent the cross domain problem.

Check this link -

Brant said...

What is srmSoaUrl?

Brant said...

What is srmSoaUrl?

Steven Pothoven said...

Apparently I missed that variable instance when scrubbing the code for publishing. Change that to realUrl.
I'll make the change here.

getify said...

I just released a plugin for flXHR ( called flXHRproxy, which makes cross-domain Ajax with Prototype dead-easy to do. Here's the plugin:

flXHR has the same API as native XHR, but is cross-domain capable, so no other code has to be changed. It just drops in and the rest is easy just like regular Ajax calls.

Anonymous said...

Thanks for the great info. I'd avoid any Flash based solution like the plague with all the Apple vs. Adobe stuff going on right now. If a user has an iPad, you are SOL with that approach.

Joel said...

How does this handle POST request parameters?