One of the things developers want is a way to perform cross site XMLHttpRequests, I am one of those. At the moment the best way to perform cross site requests via Javascript is to send a request off to your own server where there is a script sitting there waiting for your request that then goes off and performs it for you and returns back data. It works, but you need to do a little bit of work.
I was looking around the Mozilla Wiki, and it appears that Firefox 3 could support cross site XMLHttpRequests.
Cross-Site XMLHttpRequest allows a web page to read information from other web servers using norm XMLHttpRequest. In the past this has not been permitted since the other server may be sitting inside a corporate firewall or may be a server where the user is logged in.
To solve this problem it is suggested that the accessed server can signal back to the browser that it is ok for other sites to access certain pages on the server. Firefox checks for this and only returns the response to the page if the server explicitly allow.
The main concern at the moment is security. This month there is going to be a review for the feature to address the security issues. According to Jonas Sicking on the mailing list…
For Firefox 3 we’re planning on adding support for cross site
XMLHttpRequest. To make sure that this new feature will be as safe as
possible we are planning on holding a security review for the feature this
coming wednesday (2/21) at 3pm PST (11pm GMT). We’ll go through both
security issues in the feature itself and potential security issues in the
implementation design.
The idea of the meeting is not to solve every concern that we can come up
with, but rather try to come up with an extensive list of possible security
problems that we need to check the final implementation for.
A background document that contains an initial list of possible security
issues is available here:
http://wiki.mozilla.org/Cross_Site_XMLHttpRequest
I had a quick glance at the background document, and it appears that domains will use some sort of xml file, a bit like the cross domain policy file that is currently used. So I assume you will be able to specify what domains can make cross site requests to your domain.
So yeah, good things coming, shame other vendors aren’t as keen.