Simon Willison's Weblog: ajax

Is it probable that one of the major forum software packages will support Ajax soon?

2013-07-19T17:49:00+00:00

My answer to Is it probable that one of the major forum software packages will support Ajax soon? on Quora

Those codebases are all terrifyingly ancient. I suggest taking a look at http://www.discourse.org/ instead which is a much more modern take on forum software.

Tags: ajax, frameworks, quora

How does a web page interact with a server to parse a dynamic JSON file?

2013-07-06T14:54:00+00:00

My answer to How does a web page interact with a server to parse a dynamic JSON file? on Quora

If you're only dealing with 60 records there's no need to add a full database. I've actually hand coded a 50 record JSON file before and it was fine- use an editor with good JSON support (I like Sublime Text 2) and it's pretty easy to hand write.

Another option that might work well for this particular situation is to put the data in a Google Docs spreadsheet, which will then be able to produce JSON for you automatically: see https://developers.google.com/gd...

Tags: ajax, computer-science, databases, javascript, json, quora

What's the best way to handle logins?

2012-07-31T12:16:00+00:00

My answer to What's the best way to handle logins? on Quora

First, make sure you're storing the password as a salted hash, using a deliberately slow hashing algorithm such as bcrypt, scrypt or PBKDF2 - here are some recent articles to get you up to speed:

Here's a recent article on building a password reset function, from the same author:

http://www.troyhunt.com/2012/05/...

There are a couple of ways you could deal with keeping people logged in. The first, and probably the most sensible, is to use a session mechanism written by someone else (PHP has this functionality built in, I'm not sure what the state of the art for Perl is). Alternatively you could use a cryptographically signed cookie, but don't do that unless you're certain you understand what that means.

It should go without saying, but don't store the user's ID in a cookie and trust that - cookies can be altered so you can't trust them unless they are signed. Don't store the user's password in the cookie either.

Tags: ajax, html, web-development, quora

How do you change page content and URL without reloading the whole page?

2012-02-11T13:25:00+00:00

My answer to How do you change page content and URL without reloading the whole page? on Quora

This can only be done using JavaScript. You use XMLHttpRequest to pull in new information from the server (also known as Ajax - most people use a JavaScript library such as jQuery to handle this) and then use the HTML5 history API, in particular the pushState method, to update the URL.

Sadly pushState isn't supported by IE versions older than IE10 - it's up to you if you resort to fragment identifier URL hacks to support that browser or (my preferred approach) just leave IE users with full page refreshes. Sadly most versions of the Android browser don't support pushState either, and performance constraints on mobile means they are harder to ignore than IE.

Tags: ajax, javascript, jquery, web-development, quora

Going Postel

2011-02-09T02:18:00+00:00

Going Postel

Jeremy points out that one of the many disadvantages of publishing JavaScript dependent content on the Web is that a single typo can render your entire site unusable.

Tags: ajax, jeremy-keith, urls, recovered, gawker, hashbanghell

Breaking the Web with hash-bangs

2011-02-09T02:17:00+00:00

Breaking the Web with hash-bangs

Mike Davies explains why Gawker’s new Ajax fragment-tastic redesign is a web architecture error of colossal proportions.

Tags: ajax, urls, recovered, gawker, hashbanghell, mike-davies

Why do websites contain multiple webpages when they could use AJAX?

2011-02-04T09:46:00+00:00

My answer to Why do websites contain multiple webpages when they could use AJAX? on Quora

Because it shouldn't require a full-blown JavaScript interpreter just to access content on the Web.

Tags: ajax, computer-science, web-development, quora

Why do browsers allow cross-domain JavaScript to execute but not XMLHttpRequests?

2010-12-07T13:37:00+00:00

My answer to Why do browsers allow cross-domain JavaScript to execute but not XMLHttpRequests? on Quora

It's called the Same Origin Policy, and it's principally about intranets. Imagine you have a URL http://intranet.corp/top-secret-... - and you then visit http://evil.example.com/ . If cross domain XHR was allowed the evil site could suck that secret document off your intranet without you realising.

JavaScript should really have the same restrictions (I shouldn't be able to load http://intranet.corp/top-secret-... ) but as I understand it no one spotted the problem until the entire Internet economy was already dependent on externally hosted scripts as a business model.

Tags: ajax, javascript, security, web-development, quora

If I have data that loads using json / JavaScript will it get indexed by Google?

2010-10-29T15:30:00+00:00

My answer to If I have data that loads using json / JavaScript will it get indexed by Google? on Quora

No. Personally I dislike sites with content that is only accessible through JavaScript, but if you absolutely insist on doing this you should look in to implementing the Google Ajax Crawling mechanism: http://code.google.com/web/ajaxc...

Tags: ajax, jquery, json, seo, web-development, quora

Side-Channel Leaks in Web Applications

2010-03-23T16:24:02+00:00

Side-Channel Leaks in Web Applications

Interesting new security research. SSL web connections encrypt the content but an attacker can still see the size of the HTTP requests going back and forward—which can be enough to extract significant pieces of information, especially in applications that make a lot of Ajax requests.

Tags: ajax, http, security, sidechannel, ssl

flXHR

2009-11-26T12:52:16+00:00

flXHR

I was looking for something like this recently, glad to see it exists. flXHR is a drop-in replacement for regular XMLHttpRequest which uses an invisible Flash shim to allow cross-domain calls to be made, taking advantage of the Flash crossdomain.xml security model.

Tags: ajax, crossdomain, flash, flxhr, javascript, swf, xhr

Deep Tracing of Internet Explorer

2009-11-18T08:06:47+00:00

Deep Tracing of Internet Explorer

dynaTrace Ajax looks like an awesome tool. For once, Internet Explorer has a development tool that other browsers can be jealous of.

Tags: ajax, debugging, dynatraceajax, internet-explorer, javascript, john-resig

Official Google Webmaster Blog: A proposal for making AJAX crawlable

2009-10-08T17:52:31+00:00

Official Google Webmaster Blog: A proposal for making AJAX crawlable

It's horrible! The Google crawler would map url#!state to url?_escaped_fragment_=state, then expect your site to provide rendered HTML that reflects that state (they even go as far as to suggest running a headless browser within your web server to do this). Just stick to progressive enhancement instead, it's far less hideous. It looks like the proposal may have originated with the GWT team.

Tags: ajax, crawling, google, gwt, javascript, progressive-enhancement, search-engines, seo

breaking links

2009-10-08T08:26:08+00:00

breaking links

Mike complains about sites such as Twitter and WordPress.com which mess around with Ajax and links and hence breaks the ability to command-click to open a new tab in Safari (and Chrome). I just realised that I’ve subconsciously retrained myself to right click and select “open in new tab” to avoid that exact issue.

Tags: ajax, broken, javascript, links, michal-migurski, usability

Quoting Iain Lamb

2009-08-18T12:27:31+00:00

rather baffling finding: POST requests, made via the XMLHTTP object, send header and body data in separate tcp/ip packets [and therefore,] xmlhttp GET performs better when sending small amounts of data than an xmlhttp POST

— Iain Lamb

Tags: ajax, get, http, iainlamb, performance, post, xmlhttprequest

Announcing Alice and Wonderland

2009-07-17T09:12:45+00:00

Announcing Alice and Wonderland

Continuing the RabbitMQ “stuff to do with rabbits” naming convention, Alice is a RESTful interface to RabbitMQ which exposes information about vhosts/queues/users/exchanges/etc as JSON. Wonderland is a web UI for RabbitMQ implemented as a pure Ajax application which calls Alice.

Tags: ajax, alice, aliceinwonderland, javascript, json, message-queues, queues, rabbitmq, rest, wonderland

Building Fast Client-side Searches

2009-03-19T15:35:03+00:00

Building Fast Client-side Searches

Flickr now lazily loads your entire contact list in to memory for auto-completion. Extensive benchmarking found that a control character delimited string was the fastest option for shipping thousands of contacts around as quickly as possible.

Tags: ajax, autocomplete, flickr, javascript, json

AJAX APIs Playground

2009-01-22T18:38:56+00:00

AJAX APIs Playground

Ferociously useful collection of executable and editable example code for all(?) of Google’s JavaScript APIs, including Google Maps and the increasingly interesting Visualization API.

Tags: ajax, google, google-maps, googlevisualization, javascript

Sloppy - the slow proxy

2009-01-13T16:17:41+00:00

Sloppy - the slow proxy

Java Web Start GUI application which runs a proxy to the site of your choice simulating lower connection speeds—great for testing how well your ajax holds up under poor network conditions.

Tags: ajax, java, javascript, javawebstart, performance, proxies, richard-dallaway, sloppy

A Snapshot of The Yahoo! Photos Beta (from 2006)

2009-01-12T22:21:16+00:00

A Snapshot of The Yahoo! Photos Beta (from 2006)

Scott Schiller shares an internal retrospective on the Yahoo! Photos interface from 2006, which was years ahead of its time (they started building it before the term Ajax had even been coined). The material on memory management and event delegation is particularly interesting.

Tags: ajax, eventdelegation, javascript, scott-schiller, yahoo, yahoo-photos, yui

jQuery history plugin

2008-11-07T17:32:48+00:00

jQuery history plugin

I used this plugin to add back button support to a small Ajax app today, with great results. I tried it a while ago and it didn’t work in Safari, but someone has updated it since and now it works perfectly.

Tags: ajax, backbutton, history, javascript, jquery, plugins

CSSHttpRequest

2008-10-23T18:25:43+00:00

CSSHttpRequest

Devious cross-domain Ajax hack that uses CSS for transport (@import rules with data URIs, but it still works in IE). Similar to JSONP but safer, since JSONP can cause arbitrary JavaScript to execute.

Via Mike Migurski

Tags: ajax, atimport, crossdomain, css, csshttprequest, javascript, json, jsonp

When Ajax Attacks! Web application security fundamentals

2008-09-20T16:16:13+00:00

When Ajax Attacks! Web application security fundamentals

Slides and notes from my talk on web application security at @media Ajax last Tuesday.

Tags: ajax, atmediaajax, atmediaajax2008, csrf, javascript, security, slides, speaking, my-talks, xss

When Ajax Attacks! Web application security fundamentals

2008-09-17T23:18:00+00:00

When Ajax Attacks! Web application security fundamentals

Slides and (other people’s) notes from my presentation at @media Ajax on Tuesday.

Tags: ajax, atmediaajax, atmediaajax08, csrf, javascript, security, speaking, my-talks, xss, recovered

Quoting Dion Almaer

2008-05-27T17:58:18+00:00

If we see good usage, we can work with browser vendors to automatically ship these libraries. Then, if they see the URLs that we use, they could auto load the libraries, even special JIT'd ones, from their local system. Thus, no network hit at all!

— Dion Almaer

Tags: ajax, browsers, dion-almaer, google, libraries

Google AJAX Libraries API

2008-05-27T17:56:47+00:00

Google AJAX Libraries API

Google are hosting copies of jQuery, Prototype, mooTools and Dojo on their CDN, with a promise to permanently host different versions and an optional JavaScript API to dynamically load the most recent version of a library. I wish they’d stop capitalising Ajax though.

Via Ajaxian

Tags: ajax, cdn, dojo, google, jquery, libraries, mootools, prototype-js

Google Maps now shows photos and Wikipedia articles

2008-05-14T19:10:47+00:00

Google Maps now shows photos and Wikipedia articles

Click the “More...” button. My first thought was “how do they get so many photo markers on the map?”—Firebug shows that they’re generating tiles on the server containing multiple photo markers, then when you click on one an Ajax call checks which photo is in that particular spot.

Tags: ajax, google-maps, javascript, wikipedia

Google AJAX Search API: Flash and Server Side Access

2008-04-22T19:16:50+00:00

Google AJAX Search API: Flash and Server Side Access

Over a year after Google shot down their SOAP Search API, they’ve quietly released a JSON based one under the guise of supporting “Flash and other non JavaScript environments”. Comes with the strange requirement that an HTTP referer be sent with every request; the API key is optional.

Tags: ajax, apis, google, json, search, soap, web-services

Reading binary files using Ajax

2008-04-22T19:02:02+00:00

Reading binary files using Ajax

There’s a simple trick for Firefox, and (amazingly) you can get IE to play along using a function written in VBScript.

Tags: ajax, binary, firefox, internet-explorer, javascript, vbscript, xmlhttprequest

Mibbit

2008-04-19T15:53:49+00:00

Mibbit

Excellent web-based IRC client, should be great for when pesky firewalls get in the way. Also a good candidate for use with a site-specific browser.

Via Nat

Tags: ajax, irc, mibbit, sitespecificbrowsers