Problem with JSON example in Firefox

[chris]

I've been playing around with the sample JSON RPC project and I came
across a problem. I made one change to the project which was to change
DEFAULT_SEARCH_URL to the real yahoo url instead of the
search-results.js file. I tested it in hosted mode and it works fine.
Then I compiled it and tried to run it in Firefox. However, when I
click on the 'Search' button, nothing happens. I checked it on IE
again and it works.

Any clue what's going on?

[cmeerbeek]

I have the same problem. Programmed the example at
http://angel.hurtado.googlepages.com/tutorialgwt2 and changed some
code.
Works fine in IE6 but not in FF 1.5.0.3. It just doesn't respond.

[Scott Blum]

Hey Chris,

Without digging into it, my guess would be a security issue. Firefox
may interpret your trying to load the script off of Yahoo as a
potential cross-site scripting (XSS) attack and prevent it. I don't
know whether Firefox is being unnecessarily paranoid or IE is being
lax. This is just a guess, it could be something else entirely.

Scott

[chris]

Hi Scott,

Will you be looking into this further? Since my web host doesn't offer
java j2ee support, I'm thinking the PHP w/ JSON solution is the way to
go but it would suck if there was no Firefox support. =)

[Scott Blum]

Chris,

It should definitely work if you are serving up the JSON responses off
the same server the HTML page came from. The with searchresults may be
that it's serving the page from localhost but trying to get a response
from yahoo.com? I'll see if I can find out more.

Scott

[Miguel Méndez]

Chris,

Scott is right.  Technically, the JSON responses must come from the same server that served the HTML page.  The confusing thing is that it may "work" for some of the different browser and current security settings.  I had a similar experience with IE and FF due to the security settings on my box.

It sounds like what you want is a Cross-Domain Proxy.  Check out the following link: http://ajaxpatterns.org/Cross-Domain_Proxy.  It does a decent job of explaning the issues.

--
Miguel Mendez
GWT Engineer

[chris]

Thanks guys. I now have a better understanding of what's happening and
I got things working now.

[Bin]

Hi Chris,

I am having the same problem as you. I modified the JSON example to
talk to my own server. My server is running on the localhost and the
pages are served from the localhost too. But still, it only worked on
IE but not FireFox or Opera. Could I know how you solved your problem?

thanks,
Bin

[Scott Blum]

Bin,

Are you running the pages and server from different ports? I think
that can trigger XSS protections as well.

Here's something you can try:
http://groups.google.com/group/Google-Web-Toolkit/browse_thread/thread/9c4e1ebfac7b665d

Scott

[Bin]

Scott,

I think you are right. The pages and the server are running from
different ports on the same machine. I will try them on the same port.

We implement the service as a web service. So probably we want to
separate the web pages from the web service. Ideally, what we want to
do is to serve the web pages from the normal http port. In the web
pages, there is a JavaScript callback to the web service running on
the other port on the same machine. Is there any ways to do this?

thanks,
Bin