Mainly Same Origin Policy is designed for things like XML or other people's
HTML (which you can only deliver up in things like iframes). Because there
are sometimes perfectly good reasons to pull data from another domain, a
server can employ CORS to serve up the data to compatible browsers. You're
correct that normally you need server-side script to snag such files from
other domains.

Best regards,
*Jason Bengtson, MLIS, MA*

Head of Library Computing and Information Systems
Assistant Professor, Graduate College
Department of Health Sciences Library and Information Management
University of Oklahoma Health Sciences Center
405-271-2285, opt. 5
405-271-3297 (fax)
[log in to unmask]
http://library.ouhsc.edu
www.jasonbengtson.com

NOTICE:
This e-mail is intended solely for the use of the individual to whom it is
addressed and may contain information that is privileged, confidential or
otherwise exempt from disclosure. If the reader of this e-mail is not the
intended recipient or the employee or agent responsible for delivering the
message to the intended recipient, you are hereby notified that any
dissemination, distribution, or copying of this communication is strictly
prohibited. If you have received this communication in error, please
immediately notify us by replying to the original message at the listed
email address. Thank You.
<[log in to unmask]>

On Tue, Jan 13, 2015 at 9:26 AM, Anna Headley <[log in to unmask]> wrote:

> Okay, yes, thank you for clarifying! I think the opening line of
> Wikipedia's CORS page [1] is a little misleading.
>
> So I can load the js in my page from a different domain, but I can't use
> javascript to grab content / data from another domain -- and that is where
> CORS / JSONP would come in. Correct?
>
> The last time I was working around that issue standard practice was for the
> js to call a script on your own server, which then went out and grabbed the
> data for you.
>
> Thanks,
> Anna
>
> [1]
>
> http://en.wikipedia.org/wiki/Cross-origin_resource_sharing#cite_note-mozhacks_cors-1
>
>
> On Tue, Jan 13, 2015 at 10:02 AM, Jason Bengtson <[log in to unmask]>
> wrote:
>
> > You don't need CORS or JSONP for straight javascript (in fact JSONP is
> > designed to get past SOP by getting the browser to treat a JSON file as
> > regular javascript). You can load js from anywhere on the web, basically.
> >
> > Best regards,
> > *Jason Bengtson, MLIS, MA*
> >
> > Head of Library Computing and Information Systems
> > Assistant Professor, Graduate College
> > Department of Health Sciences Library and Information Management
> > University of Oklahoma Health Sciences Center
> > 405-271-2285, opt. 5
> > 405-271-3297 (fax)
> > [log in to unmask]
> > http://library.ouhsc.edu
> > www.jasonbengtson.com
> >
> > NOTICE:
> > This e-mail is intended solely for the use of the individual to whom it
> is
> > addressed and may contain information that is privileged, confidential or
> > otherwise exempt from disclosure. If the reader of this e-mail is not the
> > intended recipient or the employee or agent responsible for delivering
> the
> > message to the intended recipient, you are hereby notified that any
> > dissemination, distribution, or copying of this communication is strictly
> > prohibited. If you have received this communication in error, please
> > immediately notify us by replying to the original message at the listed
> > email address. Thank You.
> > <[log in to unmask]>
> >
> > On Tue, Jan 13, 2015 at 8:47 AM, Anna Headley <[log in to unmask]> wrote:
> >
> > > Thanks for these suggestions! The details of our requirements are still
> > > being determined, but I expect it will involve placing the same
> > js-powered
> > > navbar on multiple sites hosted on different servers with varying
> degrees
> > > of access, from entirely in-house to entirely hosted with some ability
> to
> > > customize. I think plan A will be to pull in js using CORS and/or
> JSONP.
> > >
> > > Meanwhile I will resign myself to an eternity of wondering what thread
> my
> > > brain managed to warp onto this topic.
> > >
> > > Best,
> > > Anna
> > >
> > >
> > > On Sat, Jan 10, 2015 at 9:12 PM, Joe Hourcle <
> > > [log in to unmask]>
> > > wrote:
> > >
> > > > On Jan 10, 2015, at 8:37 PM, Jason Bengtson wrote:
> > > >
> > > > > Do you have access to the server-side? Server side scripting
> > languages
> > > > (and
> > > > > the frameworks and CMSes built with them) have provisions for just
> > this
> > > > > sort of thing. Include statements in PHP and cfinclude tags in
> > > > coldfusion,
> > > > > for example. Every Content Management System I've used has had a
> > > > provision
> > > > > to create reusable content that can be added to multiple pages as
> > > blocks
> > > > or
> > > > > via shortcodes. If you can use server-side script I recommend it;
> > > that's
> > > > > really the cleaner way to do this sort of thing. Another option you
> > > could
> > > > > use that avoids something like iframes is to create a javascript
> file
> > > > that
> > > > > dynamically creates the navbar dynamically in your pages. Just
> > include
> > > > the
> > > > > javascript file in any page you want the toolbar to appear in. That
> > > > method
> > > > > adds some overhead to your pages, but it's perfectly workable if
> > > > > server-side script is out of reach.
> > > >
> > > >
> > > > The javascript trick works pretty well when you have people
> > > > mirroring your site via wget (as they won't run the js, and
> > > > thus won't try to retrieve all of the images that are used
> > > > to make the page pretty every time they run their mirror job.
> > > >
> > > > You can see it in action at:
> > > >
> > > >         http://stereo-ssc.nascom.nasa.gov/data/ins_data/
> > > >
> > > > The drawback is that some browsers have a bit of a flash
> > > > when they first hit the page.  It might be possible to
> > > > mitigate the problem by having the HTML set the background
> > > > to whatever color the background will be changed to, but I
> > > > don't quite the flexibility to do that in my case, due to
> > > > how the page is being generated.
> > > >
> > > > -Joe
> > > >
> > > > ps.  It's been years since I've done ColdFusion, but I
> > > > remember there being a file that you could set, that would
> > > > automatically getting inserted into every page in that
> > > > directory, or in sub-directories.  I want to say it was
> > > > often used for authentication and such, but it might be
> > > > possible to use for this.  If nothing else, you could load
> > > > header into a variable, and have the pages just print the
> > > > variable in the right location.
> > > >
> > >
> >
>