Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also allowing third parties to create their own views as well. The idea is that all model manipulation will be done through its API, and only the model will communicate to the (main) server, but users will be allowed to include scripts from other domains that also use that API (those scripts might "call home" if they want to though).

I know many sites already do that, for instance when they use a CDN to provide libraries like jQuery. However, I also recall reading that those libraries had to be "tweaked" somehow so they won't be mistaken by XSS attacks, though I couldn't find more info on the subject. I have only superficial knowledge of how browsers isolate contents for different domains, and to what extent that isolation occurs, so some pointers in that direction would be very welcome.

I'm also aware of the method of using iframes to load "less-than-trusted" contents, and it seems that communication between the main page and its iframes is quite straightforward. I'd rather not use that method, but will do if there are good security benefits of doing so. However, I'm unsure if that's the case, since the iframe can call arbitrary methods on the parent page... (Edit: from what I understood of Florian Margaine's comment, the method in the linked question only works for same-origin iframes, is that correct? In that case, I can see the security benefits now) Can anyone with experience on the subject tell me how it works?

These are the only options I know of, other suggestions are welcome too. I'd also like to note that, while there must be some level of trust between the user and the third party providing the script (since its very purpose is manipulating the model owned by that user), each user will be free to choose extensions at his leisure (i.e. the available scripts won't be restricted to ones I previously evaluated and endorsed), so any means to mitigate security problems to the users are also welcome.

Edit: Let me clarify the question a bit. The goal here is not to make HTTP requests to other domains, merely to have a better control of what the different scripts do to the same page. From what I understood so far of the same origin policy, different pages can not communicate to each other unless they come from the same domain, but scripts in the same page but coming from different domains can do whatever they want. Is that correct? (if it is, then I guess my question is moot...)

  • 1
    Read up on JSONP en.wikipedia.org/wiki/JSONP
    – Dan Diplo
    May 18, 2012 at 19:26
  • 1
    Iframes from another domain have no access to the parent page. May 18, 2012 at 20:08
  • @FlorianMargaine I didn't know that, thanks! What about the converse, can the parent page access the iframe's contents? (DOM, js environment) Or is the relation between them the same as, say, two tabs on the same browser? (in which case I'd have to use something like postMessage to make the communication work)
    – mgibsonbr
    May 18, 2012 at 20:30
  • @DanDiplo (and Tom Squires) thanks for the JSONP suggestion. Unfortunatly, that was not what I meant with my question (see the update). I'm not a native English speaker, and may have given a bad title to it... ("cross-site scripting" refer only to http requests?)
    – mgibsonbr
    May 18, 2012 at 20:50
  • The opposite is the same too :) Cross-domain iframe can't access each other. May 18, 2012 at 20:54

1 Answer 1


You can use JSONP. Its not so hard to write a little function yourself, here is a little example from one of my sites;

function ecbCreateScript(url, callback) {
    var head = document.getElementsByTagName('head')[0];
    var script = document.createElement('script');
    script.type = 'text/javascript';
    script.src = url;

    script.onreadystatechange = loadEcbForm;
    script.onload = loadEcbForm;

    // fire the loading
  • Accepted, since it's in fact the right answer to how perform cross-domain requests. But for anyone interested in the security implications of it, see also this question at security.SE. In short, JSONP can be made safer by using a dedicated iframe for it, but sandboxed to allow scripting but deny top level navigation and same origin benefits.
    – mgibsonbr
    May 22, 2012 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.