CODEWITHSUNDEEP
javascriptxss
Niclas
Niclas

Reputation: 1406

javascript callback on popup from other domain possible?

I'm looking for a pure javascript way to:

* refer to a javascript from a different domain than the current page.
* the javascript launches(after a user click) a popup to the same domain the javascript is loaded from.
* the popup calls a callback, in the current page, when a result in the popup window is achieved.
* no additional server files on the domain of the current page.

Is the really possible or does it violate all xss protections out there? I believe Facebook has achieved. With there fb connect api.

Thanks for any help!

Upvotes: 1

Views: 192

Answers (2)

Hugo Stieglitz
Hugo Stieglitz

Reputation: 55

Facebook has achieved, but they are appearently also relying on Flash in order to support older browsers.

@see http://hustoknow.blogspot.de/2011/06/deconstructing-facebooks-flash-cross.html

In my current project we just dumped IE7 with a fallback solution and proceeded with HTML5s postMessage -> http://caniuse.com/#search=postMessage

Upvotes: 0

Erlend
Erlend

Reputation: 4416

You could use HTML5's postMessage, but it will not work in older browsers. EasyXDM allows this for all browsers, by using hacks on older browsers. The simplest thing for this scenario would be to have the popup redirect back to first domain on completion, and have javascript on the redirected-to page that calls the callback

Upvotes: 1

Related Questions