The easiest way I've found so far is to dynamically create a script object on the page and set its .src to some dynamic page (which can, by the nature of script src be on any server). You have to have your remote script serve back Javascript, but that's about it. Google uses something like it to do their content ad RPC's when you opt for the Javascript method rather than the IFrame.

I like that a lot! Use the DNS system to outwit the stupid XMLHttpRequest sandbox. Way cool.

Thanks, but while the restrictions on XHR are heavy, they aren't stupid. An unnamed party used the same idea to implement a LAN sniffer: each successive root domain pointed to the IP addresses of well-known routers, like 192.168.15.1. The script ran down the chain and attempted to log in to the admin page of the router, using default passwords.

The real point is that with enough smarts, you can get around the restrictions, so you might as well eliminate them altogether so that there's no false sense of security.

I feel that way sometimes when I can't do something cool. But it passes. No restrictions on user processes is a major reason why "Windows security" is a contradiction, for example. It doesn't work in an adversarial networked environment.

Nice.

Not that I approve. But nice.

I'm a JSON person myself. Ran into too many problems with domains and XMLHttpRequest. From a security standpoint, the entire browser is broken, but that's probably a discussion for another day. Neat how you re-routed.