Peter Lubbers - Pro HTML 5 Programming

126
CHAPTER 5 ■ USING THE COMMUNICATION APIS
XMLHttpRequest Level 2
XMLHttpRequest is the API that made Ajax possible. There are many books about XMLHttpRequest and
Ajax. You can read more about XMLHttpRequest programming in John Resig’s Pro JavaScript
Techniques, (Apress, 2006).
XMLHttpRequest Level 2—the new version of XMLHttpRequest—has been significantly enhanced.
In this chapter, we will be covering the improvements introduced in XMLHttpRequest Level 2. These
improvements are centered on the following areas:
• Cross-origin XMLHttpRequests
• Progress events
Cross-Origin XMLHttpRequest
In the past, XMLHttpRequest was limited to same-origin communication. XMLHttpRequest Level 2
allows for cross-origin XMLHttpRequests using Cross Origin Resource Sharing (CORS), which uses the
origin concept discussed in the earlier Cross Document Messaging section.
Cross-origin HTTP requests have an Origin header. This header provides the server with the
request’s origin. This header is protected by the browser and cannot be changed from application code.
In essence, it is the network equivalent of the origin property found on message events used in Cross
Document Messaging. The origin header differs from the older referer [sic] header in that the referer is a
complete URL including the path. Because the path may contain sensitive information, the referer is
sometimes not sent by browsers attempting to protect user privacy. However, the browser will always
send the required Origin headers when necessary.
Using cross-origin XMLHttpRequest, you can build web applications that use services hosted on
different origins. For example, if you wanted to host a web application that used static content from one
origin and Ajax services from another, you could use cross-origin XMLHttpRequest to communicate
between the two. Without cross-origin XMLHttpRequest, you would be limited to same-origin
communication. This would constrain your deployment options. For example, you might have to deploy
the web application on a single domain or set up a subdomain.
As shown in Figure 5-4, cross-origin XMLHttpRequest allows you to aggregate content from
different origins on the client side. Additionally, you can access secured content with the user’s
credentials if the target server allows it, providing users with direct access to personalized data. Serverside
aggregation, on the other hand, forces all content to be funneled through a single server-side
infrastructure, which can create a bottleneck.