access is denied when using ajaxjson

[sgagn0]

I use ajaxjson to retrieve info to display (building html in javascript)
It is working fine using firefox but i get "access is denied" using ie9.
Looks like a cross-domain issue. Should i use something other than ajaxjson?

[Scott Klement]

For security purposes, AJAX can typically only connect to the same server that the page was served from. Is that what you're seeing? You're trying to use AJAX to connect to a different server? If so, can you explain more about what you're trying to accomplish?

[Scott Klement]

I should add... the cross-domain restriction will be the same no matter which ajax library you use. It's a restriction in the browser, not in the JavaScript code.

But, it's not clear to me whether that's what you're seeing or not?

[sgagn0]

We have 2 different http servers configured. One for profound and one for our web services.
From a profound page I do the following:
ajax({
url: "http://ourApacheaddress/ws/getVessels",
postData : "<GetRequest></GetRequest>",
method: "post",
async: true,
handler: infoHandler
});

The response is in XML format. It works fine in Firefox, IE10, but not in IE9 (see attached document for error messages).

[Scott Klement]

That looks like the cross-site scripting problem you described in the first message. As I said before, it'll be a problem to use any AJAX framework this way (not just our ajaxlibrary.js).

To avoid this, you need to make sure you use:

• same protocol (http or https) as the original page
• same host name (IP address or domain name) as the original page
• same port number as the original page

Are you doing that?

[sgagn0]

We were not planning of doing so (having same domain and port) as cross-domain was working fine in firefox and ie10. We were make aware of an issue when someone tried to go on the page using ie9 (which happened only a few days after we started to configure our web services).
Also, our web services will be called from many different applications (intranet, client zone, web site, profound pages), so we would like to have our web services only at one place. Everyone would access web services through the same IP and port (we have setup an apache instance dedicated to our web services)

We are newbies in regards to web services so maybe we are not doing it the right way.

[sgagn0]

I got it to work by using xdr
Something like:
if(window.XDomainRequest){
var xdr = new XDomainRequest();
xdr.open("post", "http://ourwebserviceaddress/ws/getvessels");
xdr.onprogress = function () { };
xdr.ontimeout = function () { };
xdr.onerror = function () { };
xdr.onload = function() {
infoHandler(xdr.responseText);
}
setTimeout(function () {xdr.send("<GetRequest></GetRequest>");}, 0);
}

[Scott Klement]

XDomainRequest is a non-standard (Microsoft-only) API. I see that you're looking to see if it exists, first... I assume that if it does not, you are using XHR instead? That might be a good solution.

The other way, of course, is to set up a proxy on your IBM i so that you can point it back to the same server, and it uses the proxy to redirect to the web service.

[sgagn0]

It works fine with the proxy, but I am not sure if I did it properly or not.
The only thing I did was adding the following two lines in our Profound configuration:
ProxyPass /ws/ http://OurWebServicesAddress/ws
ProxyPassReverse /ws/ http://OurWebServicesAddress/ws

So when using profound/ws everything is redirect to our web services server.

Is it the right way to do it? If so, i prefer, by far, this method.

[Alex]

It looks to me like you did it properly. This is all that you have to do.