From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <arthompson1990@gmail.com>
Received: from mail-lf0-x230.google.com (mail-lf0-x230.google.com
 [IPv6:2a00:1450:4010:c07::230])
 by hurricane.the-brannons.com (Postfix) with ESMTPS id 535C279E0D
 for <Edbrowse-dev@lists.the-brannons.com>;
 Tue, 27 Dec 2016 10:26:16 -0800 (PST)
Received: by mail-lf0-x230.google.com with SMTP id b14so191768633lfg.2
 for <Edbrowse-dev@lists.the-brannons.com>;
 Tue, 27 Dec 2016 10:26:40 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=date:from:to:cc:subject:message-id:references:mime-version
 :content-disposition:in-reply-to:user-agent;
 bh=XrBNb1KU9lxIzgpHbx0aHCbJIUditxN5fuxaNux3iYs=;
 b=HVHLDs2BaYVs97B+IGtQYd4a7tWsSM2pP6Pgkxkb/E+pyCYMRTPfNa2g/Ngo3r8SnM
 PJOJcrDaCbY3xh+pqZZ/0uFe3Yf3qRUKFAa7+w+/sDI9AjY2/SV9ACV5d6qCUFOQhF57
 y31NTzHjhZgicaRZkwAgnXJx/2mhAWjPS9zqTRr3F3iVQaeG9pECLm1JohyExBY7Pw5j
 i85HTncESNy+ES5Ydmkw8AjX2GfO3QVYXgwF2VGhbyfRYqaxnilW1i3378V2pPW9rICa
 0Do0mEcjpP83U6qBM3Y3pT33JaZYcH9k2d5+BP67QT40Baj3SqNL+nAoPzC1PcAcKJsD
 7SAg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:date:from:to:cc:subject:message-id:references
 :mime-version:content-disposition:in-reply-to:user-agent;
 bh=XrBNb1KU9lxIzgpHbx0aHCbJIUditxN5fuxaNux3iYs=;
 b=hSoMYkKSfbvc1vybCPL2CgYFm6cHwC/05AhY6MCL9f5PMjMeZQqJWc59btyEcBrmVM
 JL1ZyyBXJXBi1rrcIpGbOYBBDoj5zEzTInxNAcAKs12FQGmxwVshEWMHtRsz5tHpbxYu
 Gyo17Rby3WIYHyIv8z/KrYBd1yL91ia+0GoQk4d2NoCva8x+iVavBnGnLmNCye0CY+4V
 nI3HeW1Eohn0ZXlsrLPM6PefA1ZXYdWKElElSxev4zxFGy3LfKM301K0teAITaEJIg6L
 UPGmdpcmA/oX+EwmOFr/5ct8d+6szP0VLDPXhEOgxUg4bjIxvm476Xo11TOK3HzDB6mE
 TrXQ==
X-Gm-Message-State: AIkVDXLLYvsvWiLab9WhlPhTPdrBRdIIm+mlZzIrqqRQrFTRZn5dvHPQ9bYuWHAnmawrbw==
X-Received: by 10.46.75.1 with SMTP id y1mr12799888lja.45.1482863198271;
 Tue, 27 Dec 2016 10:26:38 -0800 (PST)
Received: from odin (odin.sdf-eu.org. [178.63.35.194])
 by smtp.gmail.com with ESMTPSA id y25sm11592501lja.13.2016.12.27.10.26.36
 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
 Tue, 27 Dec 2016 10:26:37 -0800 (PST)
Date: Tue, 27 Dec 2016 18:26:20 +0000
From: Adam Thompson <arthompson1990@gmail.com>
To: Karl Dahlke <eklhad@comcast.net>
Cc: Edbrowse-dev@lists.the-brannons.com
Message-ID: <20161227182620.GA8364@odin>
References: <20161127111251.eklhad@comcast.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature"; boundary="UlVJffcvxoiEqYs2"
Content-Disposition: inline
In-Reply-To: <20161127111251.eklhad@comcast.net>
User-Agent: Mutt/1.5.23 (2014-03-12)
Subject: Re: [Edbrowse-dev] XMLHttpRequest
X-BeenThere: edbrowse-dev@lists.the-brannons.com
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: Edbrowse Development List <edbrowse-dev.lists.the-brannons.com>
List-Unsubscribe: <http://lists.the-brannons.com/mailman/options/edbrowse-dev>, 
 <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=unsubscribe>
List-Archive: <http://lists.the-brannons.com/mailman/private/edbrowse-dev/>
List-Post: <mailto:edbrowse-dev@lists.the-brannons.com>
List-Help: <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=help>
List-Subscribe: <http://lists.the-brannons.com/mailman/listinfo/edbrowse-dev>, 
 <mailto:edbrowse-dev-request@lists.the-brannons.com?subject=subscribe>
X-List-Received-Date: Tue, 27 Dec 2016 18:26:16 -0000



--UlVJffcvxoiEqYs2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Tue, Dec 27, 2016 at 11:12:51AM -0500, Karl Dahlke wrote:
> Since almost the dawn of html, <frame> and <iframe> can cause a browser
> to fetch other html, perhaps from another domain, and paste the result into the web page.
> In this regard edbrowse is more manual than any other browser; you have to click on a link to fetch in the frame.
> Not saying I like it that way, I don't, it was just easier at the time.
> Anyways other browsers just do it, without worrying about security,
> I don't think XMLHttpRequest is any different; except js is directing the http fetch,
> and perhaps using the result in some computational way,
> rather than html directing the fetch and browsing the result.

Actually that's not quite correct.  What browsers usually do is use something
called CORS (cross origin resource sharing) to decide whether a particular
request is ok.

The implementation is a bit complicated but it's basically based on http headers
telling browsers whether access to a resource is allowed.  Specifically this
applies when a request is cross-domain or cross-protocol i.e. from
edbrowse.org to eklhad.net or https to http.

This is important to prevent cross-site scripting attacks and there are a
bunch of systems which implement this.  I don't have the relevant links to hand
but there's lots of documentation on the internet about various browsers'
implementations.  I think there's some kind of standard also.

> Most of the time even js just slaps the html into a <div> where it is browsed;
> just a damn fancy complicated, and dynamic, form of iframe.
> I'd be surprised if a js fetch had to draw from the same domain, but it might, IDK.
> Maybe write some test code and run it on other browsers.

It's actually quite a mixed picture as far as that's concerned.  There're a lot
of AJAX requests cross-domain (using preflite OPTION method requests to set up
CORS stuff) but there're also a bunch of systems I'm aware of using same-origin
AJAX requests for server-generated dynamic content.

> By the way, we should think about expanding all these frames and iframes, as other browsers do,
> but it's more work than first appears.
> The top half of your "buffer" is this tree from this html on this domain running this instance of js,
> and the bottom half of your buffer is that tree from that html on that domain running that instance of js,
> so multiple js windows tied to one edbrowse window, which we can't do now, etc etc.
> definitely some work there; for now an improved dom and jquery is more important.

Agreed.  Though it'd be good, if we ever do this, to mark the frames somehow.  I
*think* js may have access to these frames somehow but I'm not sure what the DOM
looks like for this.

Cheers,
Adam.

--UlVJffcvxoiEqYs2
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJYYrJLAAoJED6sZNk+oYF/U8kQAIFhAyG03V7RHzEHVVUVtnL+
r2gHGrifvizJtHFPf1H63sNLLYAiPFBaF7vWb92G6wh+XM7L0aH9u2JGrMz0KUoh
7vDO+U/lvbKeu7cJrtJbFel+X/wbdfZoNnKoRAz9JGmplvC83/u/tY9jsXnAbm3m
IuOgFzxaokdHxkqc+sbj62u7Tj+P44n+gQCs8iAo2sIRZCbjcozrPTiXnQOYVbhU
qFG4Exb9UhVxwMiNI8QZAipJgSfaj/aSMuXqV43ToZbAtyuQN9szSzgVKdbbJP+P
7E1TDhu+6WEw0BTJHElJP9GrLUCaz/nckuNGbaXwOPfcrELLwYDbOqKKAllBrBTK
w4VF5n1uKlvNG3pOKe94ce7IkVV30F0/WEsGaXthePsX4UQy+ucrncfBDY63eHq6
/3nSgzHHxdbuGjGWbMcOAr3eDwWiPQmjV+u2RU82tY5IJi6wRHWZuXlFb+I4hep5
972XIcIT681ME2rzfIVqYeZTzuUZTRUs1JkR++7AglD/SSYlZz3oWyQHD/WlVm9Z
mYG3Jts9aFpRKnYF/OGkMqJ8lqmvRLv7U38z2GEf6eisXA403V3ibm8zXzx/ZQc2
umCPfw6GubJCb+LbpgZkxyOUOqGRZ+rEDZP+fSlvprg8/7EpXGDvqgEjKLpQUhae
XYaeLZMCPKrxH05kI1at
=vuQO
-----END PGP SIGNATURE-----

--UlVJffcvxoiEqYs2--