Are there any htaccess or allow-files to enable Cross Site Scripting? Javascript

Question

I need to send and load JSON data to and from a PHP script on a different domain and while the variables were passed, nothing is returned.

domain1.com/display.php (has Jquery $post() routine to send and load data) to domain2.com/data.php (php script outputs JSON data) <-- this receives data, but response is not sent to requesting script.

Of course this is due to browser security restricting cross site scripting stuffs.

I've read a bit about JSONP but that's just another extra step.

I remember when I used to do FLASH, i would just uload a policy file to the server on a different domain where I would load data from and everything would just work.

Is there anything like that for JavaScript? if not, WHY the HECK not?! Seems to me like it's a legit, hassle free solution, that's just about as secure as JSONP method, or even more so.

Regards

Answer 1

Since you say "it's Javascript that needs to load the data", I gather this is running in some browser. In this case, the browser is enforcing security, as fas as I know, and fiddling with the server( script)s will not help.

Chrome has a command-line option to turn off XS security (--disable-web-security), and Firefox has a setting in about:config (I think, can't find it right now... sorry).

But I guess there's reason to these security settings in the first place... ;-)

Answer 2

Are you trying to load it on the client? Using PHP+cURL it should be no problem on the server side. If you really need to load cross domain content on the client side you could use the Cross Domain jQuery plugin (uses YQL internally)