[whatwg] JSONRequest

[Lachlan Hunt]

Gervase Markham wrote:
> Douglas Crockford wrote:
>> The JSONRequest does only one thing:
> <snip>
> 
> Are you planning to take the excellent advice from <I forget who>
> to change the name? 

That was me.  Nice to see I'm quite memorable :-)

> The name XmlHttpRequest sucks because it doesn't
> necessarily return XML, and it doesn't have to be over HTTP.

I agree, but considering we're stuck with it...

> Why not just call it "Request",

Why not just reuse XMLHttpRequest?

> and have an API to set the Accept: header,

XHR already does.

var r = new XMLHttpRequest();
r.open("post", "http://example.org/json")
r.setRequestHeader("Accept", "application/json");
r.setRequestHeader("Content-Type", "application/json")
r.send(jsonData);

To make XMLHttp as secure as JSONRequest claims to be (assuming for the 
moment that the proposal can be made completely secure), we would just 
need to find a way to tell the UA to allow cross domain access for XHR 
under certain conditions by meeting the criteria in Security section of 
the JSONRequest proposal.

e.g. Don't send cookies, usernames, passwords, etc., prevent access to 
detailed error messages from other domains, help prevent DoS attacks to 
other domains using random delays between requests and address any other 
security concerns raised.

That way, if the conditions are met by both the script and server, the 
UA could allow access to the response, otherwise treat it as an XSS 
attack of some sort and deny it.

-- 
Lachlan Hunt
http://lachy.id.au/