APIs are accessed from different domains all the time. However, the default behavior for browsers when doing cross-domain requests is to disallow it due to the Same Origin Policy.
There is an emerging standard for explicitly whitelisting cross-domain requests called CORS. It is a W3C recommendation.
The CORS specification is quite hefty, but here's the gist of it that applies to txyoga. Before starting to make cross-domain requests, the browser will create a pre-flighted request using the OPTIONS method.
CORS won't work on all browsers currently in use.
Surprisingly, Opera is the worst offender here. Support is not available in current-day browsers (11.x), but will probably be available in 12.x.
Less surprisingly, Microsoft's implementation came late and is fairly different from what the other browsers do. They have a separate object (XDomainRequest instead of XMLHTTPRequest) that behaves the same. jQuery currently does not gloss over this difference; but may do so in the future, and currently can using a plugin (upstream ticket).
For backwards compatibility, it may be a good idea to use this information to also (perhaps optionally) generate a crossdomain.xml
file for Flash-based cross-domain access. Flash can be used as a fallback for browsers that don't support CORS using flxhr
.
Alternatively, browser implementations can use tricks such as nesting iframe
s that communicate with each other by changing the fragment. This also requires cooperation with the cross-domain site.
Both of these, if implemented, should be on a separate ticket.