search

jpillora / xdomain

A pure JavaScript CORS alternative
https://jpillora.com/xdomain/
3.12k stars 269 forks source link

Using XDomain with XDomainRequest polyfill #140

Closed kawazoe closed 9 years ago

kawazoe commented 9 years ago

We are currently using XDomain for most of our CORS queries and it works really well. We are trying to add mixpanel tracking integration to our site but obviously, we cannot add the XDomain proxy to their servers. This causes an issue in IE9 where cross domain requests that are not going through the XDomainRequest object triggers a warning message with the following warning: "This page is accessing information that is not under its control. This poses a security risk. Do you want to continue?"

We we thinking about using your CORS polyfill for those requests but we are concerned about compatibility issues. What is the expected behaviour if both XDomain and the polyfill are loaded on the page and we try to do a cross domain request on a site that is not part of the XDomain slave list? Will it work? Is there a possibility that the polyfill will prevent XDomain from working properly?

jpillora commented 9 years ago

Hi @kawazoe, that's strange, never seen that warning before? maybe it's a HTTP <--> HTTPS warning?

Have a look at "Q: XDomain is interfering with another library!" in the FAQ and try the solution there.

I briefly tested the CORS polyfill, though I'm not sure how much use its getting. The CORS polyfill should work with XDomain, if the requested domain does not have a slave domain defined.

kawazoe commented 9 years ago

maybe it's a HTTP <--> HTTPS warning?

No, we keep all queries on the same protocol, though I did test only in HTTP.

The CORS polyfill should work with XDomain, if the requested domain does not have a slave domain defined.

We tried it too and it seems to work very well as long as the polyfill is loaded after XDomain.

Since this issue is more about XDomain vs CORS Polyfill and the warning message, I will consider it resolved and close the issue.