Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest - Jon Galloway

Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

Silverlight's security model prevents making a request to another domain. For instance, if you're serving a page with a Silverlight control from www.silverlight.net, the control can't make a request to maps.google.com, flickr.com, etc; the control can only call back to the silverlight.net domain. That's probably a good thing from a security perspective - it'd just be way too easy for a page to cross security zones and other bad things if a client side networking stack could communicate with any domain it wanted.

But there are some very legitimate uses of cross domain access, such as the (overused) Google map and Flickr mashup example. There are some ways around the Silverlight domain restrictions, though. The easiest way is to use a server side proxy, so the Silverlight control only talks to the site that served it, and the server side code makes cross domain requests.

If you need to make cross domain requests on the client side, though, your Silverlight control can call through the browser's Javascript network stack using XMLHttpRequest. Firefox has a "same origin policy" for the XMLHttpRequest, but you can request expanded priveleges if you sign your script. IE handles cross domain requests via security zone policy (Local, Trusted, Intranet, Internet, Restricted). Before IE7, I believe the default access was more open than Firefox; in IE7 cross domain access is denied by default to all security zones. It seems like the best general practice is to avoid client side cross domain access and use a server side proxy.

Published Tuesday, May 08, 2007 9:31 AM by Jon Galloway

Comments

# re: Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

you can also use mod_rewrite (or an appropriate url rewriter if you are on IIS) or mod_proxy to redirect your cross-domain calls. Sometimes the src="{remote site}" trick works if you are getting  JSON back from your web service.

Tuesday, May 08, 2007 4:54 PM by Scott

# re: Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

Hey Jon,

Here's a great how to written by Garbin, a friend of mine. This article explains how to  create a local web service that acts as a proxy of the remote data service.

I'm not sure how much of this applies to Silverlight but I hope it helps.

http://dotnetslackers.com/columns/ajax/MashitUpwithASPNETAJAX.aspx

Thursday, May 10, 2007 11:14 AM by Geri Langlois

# re: Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

There was a Silverlight development session that talked about this a bit at MIX07.  It was the AJAX Patterns with ASP.NET session.  When they talked about creating Silverlight mashups using other services they addressed it a bit.  I blogged about it here:

www.paraesthesia.com/.../comments.php

They liked the idea of the server-side proxy because you can perform caching and filtering of the remotely-retrieved data so your application only gets the information it needs, though they acknowledged the bandwidth consumption and additional development costs.

The other option you have is to consume services [that offer it] using JSONP:

bob.pythonmac.org/.../remote-json-jsonp

Nikil Kothari shows an example using the Flickr API via JSONP here:

www.nikhilk.net/WPFEAndScriptSharp.aspx

It implies you trust the source, but then, even with a server-side proxy it sort of implies a certain level of trust, doesn't it?

Thursday, May 17, 2007 2:16 PM by Travis Illig

# re: Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

nah, don't care

i heard you were nobody since phil stopped workin wit you.

actually, i was tryin to explain to my boss that phil went to koders.com -- double blank stare - i said: y'know, phil who worked with jon galloway -- boss interjected: hey! he wrote that data dictionary app i use!, me: (thinking, derrr, of course, but sez) yeh, //that// jon!

full o smarties, that West coast of US.

keep doin what u do jon.

Friday, May 25, 2007 10:55 AM by lb

# re: Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

@Travis - Thanks! I missed that session, thanks for including the links.

@lb - Thanks! I was feeling a bit useless this week, what with the lack of sleep due to a newborn and all. You are the wind beneath my wings!

Friday, May 25, 2007 7:31 PM by Jon Galloway

# Calling an ASMX webservice from Silverlight? Use a static port.

The setup Rob Conery recently posted on Creating a Web Service-Enabled Login Silverlight Control , which

Friday, June 15, 2007 2:59 AM by Jon Galloway

# Silverlight 1.1 (Alpha) cross domain webservice access makes mashups tricky

Any web mashups, by definition, require cross-domain calls. Those cross-domain calls may happen on the

Wednesday, July 04, 2007 3:07 AM by Community Blogs

# re: Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

I need a lnik to cross the blocked sides any one can help me in this issue..

Sunday, February 22, 2009 6:12 AM by Mursal

# re: Silverlight - Cross domain access blocked, use a server side proxy or XMLHttpRequest

Nice Post.

----------

I love http://youtube.com

Friday, March 15, 2013 4:21 AM by Jearveeteni

Leave a Comment

(required) 
(required) 
(optional)
(required)