Hacker News Reader

Comment by kls | Hacker News Reader

Don't forget cross-site scripting if you go with any RIA web apps on the domain. I hate that one, because I would love to put all of my services on services.mydomain.com and get them out of the general app space, but it creates such a pain with scripting that it is not worth it.

View on HN

How is this different with an RIA vs non-RIA web app? You mean like something in Flash or Flex vs HTML? Not sure I get what you mean.

Are you saying it's more work for a localized app (coolapp.com/customer1/) to interact with services.coolapp.com than with coolapp.com/customer1/services. And does the latter imply that there would be massive redundancy or can one go about routing queries to avoid that?

Yes sorry, RIA is JavaScript to me. I mainly work on web-apps, and they are JavaScript intensive. The security constraints but in say that accessing services.mydomain.com is like accessing yourdomain.com so JavaScript balks at it because it views it a a cross site call. So fir simplicity sake you end up just doing mydomain/services/customer1. It is semantics but I would love to put all of my services on a sub-domain and have browser based JavaScript be able to access it. It would make moving that logical sub domain off to an app server easier as it is a DNS entry as opposed to routing rules for the /services sub folder on the domain. For SaaS it would be a god send because for each client you could set up a virtual host that pointed services.clientdomain.com to the hosted app server and provide managed services for a client with just a simple DNS entry. As it sits now, the client has to set up configurations to forward /services to the managed services. For me and what I do, allowing JavaScript XHR calls within the second level domain would simplify some things. The problem is it assumes trust across a domain and that does not hold true for larger entities, for example say you have bigco.com and it has hr.bigco.com. You really don't want all of the enterprise to be able to access sensitive HR services so that is why you get the current model. I just wish it was configurable per domain.

kls,

You've certainly taught me a thing or two. I never knew Javascript had such limitations across (sub) domains. There's an old article on it here: http://radio.javaranch.com/pascarello/2005/12/30/11359624608...

They are working on the issue http://www.w3.org/TR/2010/WD-cors-20100727/ it is just not available yet and even after browsers implement it, it will be some time before you can safely use it outside of a controlled environment. For now, you have to use an IFrame, or Flash to get around the browser restrictions of same origin policy.

Reply on news.ycombinator.com