Cross-site ajax call to a WCF Service

Question

Is it possible to do a cross-site call, in Javascript, to a WCF service?

I don't mind if it's a POST or a GET.

But I've heard that these days, browsers don't allow cross-site calls with either POST or GET.

How can I circumvent this and still call a WCF Service?

Answer 1

There's not a whole lot you can do to circumvent the browser's cross-site scripting blockers. Those blockers stop XMLHTTPRequest's from happening to any domain but the one that loaded the containing script or page.

That said, there is one commonly used workaround: Use JavaScript to write a new entry into the DOM that references a src that is a cross-site URL. You'll pass all your RPC method arguments to this "script" which will return some JavaScript that will be executed, telling you success or failure.

There's no way to do a POST in this manner, the src URL must be a GET, so you can pass arguments that way. I'm not sure if WCF has a "GET only" method of access. And, since the browser will expect the result of the remote tag to be a valid JavaScript object, you'll have to make sure that your WCF service obeys that as well, otherwise you'll get JavaScript errors.

Another common method of circumventing cross-site scripting is to write a proxy for your requests. In other words, if you want to access domain test.com from scripts hosted on example.com, then make some URL on example.com that proxies the request over to test.com in the proper way.

For your example, the proxying is likely the right answer, assuming that WCF doesn't have it's own cross-site scripting restrictions.

Answer 2

Are you using jQuery by any chance? jQuery supports Cross-Domain JSON requests using "JSONP". You will be limited to GET requests, but I've tried it out and it works well! It's also very simple to get working.

See the "Cross-Domain getJSON (using JSONP) " section on this page for details: http://docs.jquery.com/Release:jQuery_1.2/Ajax

And here's some background on JSONP: http://bob.pythonmac.org/archives/2005/12/05/remote-json-jsonp/

Let me know how it goes!

Answer 3

New W3C recommendations are being standardised to allow cross-site requests between trusted parties via the Access Control for Cross-Site Requests specification.

This requires a server serving suitable Access Control HTTP headers and a browser capable of understanding and acting upon such headers.

In short, if a remote host says it likes your domain, and a browser understands what this means, you can perform xmlHttpRequests against that host regardless of the same origin policy.

Currently very few browsers support this functionality. IE8 apparently does (I haven't tested it) and Firefox 3.1 does (I have tested this extensively). I expect other browsers to follow suit quite quickly.

You shouldn't expect sufficient adoption of compatible browsers until 2012 at the earliest.

That's the ultimate solution to the problem. The downside is waiting a few years before it can be used in mainstream applications.

If this is for use within an environment you fully control, such as for an intranet where you can determine which browser is used and where you can configure multiple servers to issue the correct headers, it works perfectly.

Answer 4

To expand on Ben's answer... I extended our WCF service to support JSONP calls from jQuery using code similar to this example from Microsoft:

http://msdn.microsoft.com/en-us/library/cc716898.aspx