<p>While cross-site scripting is generally regarded as negative, I've run into several situations where it's necessary.</p>

<p>I was recently working within the confines of a very limiting content management system.  I needed to include database code within the page, but the hosting server didn't have anything usable available.  I set up a couple bare-bones scripts on my own server, originally thinking that I could use AJAX to import the contents of my scripts directly into the template of the CMS (thus retaining dynamic images, menu items, CSS, etc.).  I was wrong.</p>

<p>Due to the limitations of <code>XMLHttpRequest</code> objects, it's not possible to grab content from a different domain.  So I thought <em>iFrame</em> - even though I'm not a fan of frames, I thought that I could create a frame that matched the width and height of the content so that it would appear native.  Again, I was blocked by cross-site scripting "protections."  While I could indeed load a remote file into the <em>iFrame</em>, I couldn't execute JavaScript to modify its size on either the host page or inside the loaded page.</p>

<p>In this particular scenario, I wasn't able to point a subdomain to my server.  <strong>I also couldn't create a script on the CMS server that could proxy content from my server, so my last thought was to use a remote JavaScript.</strong></p>

<p>A remote JavaScript works.  It breaks when the user has JavaScript disabled, which is a downside; but it works.  The "problem" I was having with using a remote JavaScript was that I had to use the JS function <code>document.write()</code> to output any content.  Any output that isn't JS causes script errors.  In addition to using <code>document.write()</code> for every line, you also have to ensure that the content is escaped - or else you end up with more script errors.</p>

<p>My solution was as follows:</p>

<p>My script received a GET parameter ("page") and then looked for the file (<code>{$page}.php</code>), and read the contents into a variable.  However, I had to use awkward buffering techniques in order to actually execute the included scripts (for things like database interaction) then strip the final content of all line break characters (<code>\n</code>) followed by escaping all required characters.  The end result is that my original script (which outputs JavaScript) accesses seemingly "standard" scripts on my server and converts their standard output to JavaScript for displaying within the CMS template.</p>

<p>While this solution works, it seems like there may be a better way to accomplish the same thing.  What is the best way to make cross-site scripting work specifically for the purpose of including content from a completely different domain?</p>

[{'answer_id': 52654, 'author': 'Jason Bunting', 'author_id': 1790, 'author_profile': 'https://Stackoverflow.com/users/1790', 'pm_score': 2, 'selected': False, 'text': '<p>Personally, I would call to that other domain <em>on the server</em> and get and parse the data there for use in your page. That way you avoid any problems and you get the power of a server-side language/platform for getting and parsing the data.</p>\n\n<p>Not sure if that would work for your specific scenario...hard to know even with your verbose description...</p>\n'}, {'answer_id': 52768, 'author': 'Jake McGraw', 'author_id': 302, 'author_profile': 'https://Stackoverflow.com/users/302', 'pm_score': 5, 'selected': True, 'text': '<p>You\'ve got three choices:</p>\n\n<ol>\n<li>Create a <a href="http://developer.yahoo.com/javascript/howto-proxy.html" rel="noreferrer">server side proxy script</a>.</li>\n<li><p>Create a remote script to read in remote dynamic HTML. Use a library like <a href="http://www.jquery.com" rel="noreferrer">jQuery</a> to make this easier. You can use the <a href="http://docs.jquery.com/Ajax/load" rel="noreferrer">load function</a> to inject HTML where needed. <strong>EDIT</strong> What I originally meant for example # 2 was utilizing <a href="http://en.wikipedia.org/wiki/JSON#JSONP" rel="noreferrer">JSONP</a>, which requires the server side script to recognize the "callback=?" param.</p></li>\n<li><p>Use a <a href="http://www.adobe.com/devnet/flash/articles/external_interface.html" rel="noreferrer">client side Flash proxy</a> and setup a <a href="http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_14213" rel="noreferrer">crossdomain.xml</a> file on your server\'s web root.</p></li>\n</ol>\n'}, {'answer_id': 65026, 'author': 'PetroleumJelliffe', 'author_id': 9096, 'author_profile': 'https://Stackoverflow.com/users/9096', 'pm_score': 0, 'selected': False, 'text': '<p>I\'ve come across that <a href="http://developer.yahoo.com/javascript/howto-proxy.html" rel="nofollow noreferrer">YDN server side proxy script</a> before.  It says it\'s built to work with Yahoo\'s Search APIs.  </p>\n\n<p>Will it work with any domain, if you simply trim the Yahoo API code out?  Or do you need to replace it with the domain you want it to work with?</p>\n'}, {'answer_id': 1084857, 'author': 'Sean Kinsey', 'author_id': 128035, 'author_profile': 'https://Stackoverflow.com/users/128035', 'pm_score': 1, 'selected': False, 'text': '<p>You could try <a href="http://easyxdm.net" rel="nofollow noreferrer">easyXDM</a>, by including very little code, you can pass data or method calls between documents of different domains. </p>\n'}, {'answer_id': 2802549, 'author': 'plop', 'author_id': 337228, 'author_profile': 'https://Stackoverflow.com/users/337228', 'pm_score': 0, 'selected': False, 'text': "<p>iframe remote content can be accessed by local javascript.</p>\n\n<p>The remote server just have to set the <code>document.domain</code> of the page.</p>\n\n<p><strong>Eg:</strong></p>\n\n<p>Site A contain an iframe with <code>src='Site B/home.php'</code></p>\n\n<p>home.php looks like this :</p>\n\n<pre><code>[php stuff]...[/php]\n[script type='text/javascript']document.domain='Site A'[/script]\n</code></pre>\n"}]
['https://Stackoverflow.com/questions/52646', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1581/']