I am feeling pretty lost when it comes to understanding the XMLHttpRequest and XDomainRequest renaissance, and I could really use some guidance. Here are my thoughts so far:
- It seems like the XDomainRequest in IE8 and IE9 is some sort of subclass of XMLHttpRequest.
- One major missing feature of XDomainRequest is the "withCredentials" property.
- XDomainRequest also lacks the "onLoad" event, requiring the use of state and status checks instead. However, onLoad is available if you instantiate XDomainRequest in IE8 and IE9, but not with an XMLHttpRequest in those browsers
- Data submitted by XDomainRequest is sent as plain text rather than as a form, meaning you have to parse the input stream on the backend.
- Even if the CORS server allows for reading the Set-Cookie header for client-side access, XDomainRequest does not expose this information, making it impossible to use session IDs stored in cookies for authentication.
- Lastly, XDomainRequest only supports POST and GET HTTP methods, limiting its usability for RESTful web services.
This list is not exhaustive and is based on my own observations. The situation becomes confusing for me because I have a specific application requirement where I need to:
- Retrieve an encryption key and associated session ID (cross-domain) via GET request.
- Encrypt a user's password using this key.
- Log in to the cross-domain service using a POST request with x-www-form-urlencoded username and encrypted password.
Due to the limitations mentioned above, I cannot achieve this using XDomainRequest:
- The restriction of sending plain text data with XDomainRequest.open() poses an issue since the third-party application expects form data format.
- The session ID received along with the encryption key through Set-Cookie header is not included in the login request headers since XDomainRequest does not expose headers.
Interestingly, disregarding these limitations and using XMLHttpRequest in IE8 and IE9 works just fine! While the onload event might be missing and the "withcredentials" functionality unclear, IE8 and IE9 seem to handle cross-domain requests without issue. This paradoxes prompt me to seek clarification: why do these contradictory behaviors exist? Is there a scenario where one can use XMLHttpRequest and not XDomainRequest? Has there been any updates addressing these issues in IE8 and IE9?
Your insights would be invaluable. Thank you, Yiannis