制作跨域API
我有一个新项目在工作。它将需要跨域的服务器到服务器和客户端到服务器消息传递，就像 Facebook API 一样。我在哪里可以找到有关该主题的优质资源？
主要问题是：
- 我们应该更喜欢在“客户端”站点中使用 iframe 还是脚本？
- 你如何创建握手？在客户端到服务器和服务器到服务器代码中？
- 如何确保此过程的安全？如何验证请求的来源？
我知道这是一个广泛的话题，但我不太熟悉它，我希望朝着正确的方向推动。
I Have a new project at work. It will require server to server and client to server messaging on a cross domain basis, just like the Facebook API. Where can I find good resources about this subject?
The main questions are:
- Should we prefer using an iframe in the 'client' site or a script?
- How do you create the handshake? both in client-to-server and server-to-server code?
- How do I make this process secure? How do I validate the origin of the request?
I know this is a broad topic, but I'm not really familiar with it, and I'd like a push in the right direction.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以首先查看由 Luke Sheppard 编写的 Facebook 跨域 (XD) 源代码
https://github.com/facebook/connect-js/blob/master/src/core/xd.js
为了向后兼容，它使用 flash 对象以及磅后的查询字符串不支持的旧版浏览器的签名技术window.postMessage()
还有一个开源的 easyXDM 库，它旨在补偿浏览器差异并为两者提供简单的 api。 （我正在评估）
http://easyxdm.net
你基本上被锁定在使用 IFrame 来制作交叉域请求。安全性是另一个大主题，您还可以检查 http 请求，了解 stackoverflow 如何使用第 3 方域进行身份验证，它们使用会话哈希和随机数令牌来确保 http 上的安全。
祝你好运！
You can start by checking out Facebook cross domain (XD) source code that was written by Luke Sheppard
https://github.com/facebook/connect-js/blob/master/src/core/xd.js
For backward compatibility it uses flash objects as well as query string after pounds sign techniques for older browsers that don't support window.postMessage()
There is also an easyXDM library which is open source, it suppose to compensate for browser differences and provide simple api for both. (I'm in process of evaluating)
http://easyxdm.net
You are basically locked in to using IFrame to make cross domain request. The security is another huge subject, you can also inspect http requests of how stackoverflow does it's authentication with 3rd party domain, they use hashing of sessions and nonce tokens to make it secure over http.
good luck!
JSONP 非常适合来自浏览器的跨域请求。它不需要 iframe、flash 或其他技巧。
浏览器仅仅请求另一个 JS 脚本。请记住，Javascript 源文件可以跨域获取。
您可以使用查询字符串参数作为 api 调用的参数。
JSONP works well for cross-domain requests from browsers. It does not require iframes, flash or other trickery.
The browser merely requests yet another JS script. Remember that Javascript source files can be fetched cross-domain.
You can use query string args as parameters to the api call.