目前（2011 年）通过跨域 AJAX 进行 REST 是一个坏主意吗？
我正在编写一个 REST 服务，Web 应用程序、桌面客户端、移动客户端等可以通过 REST 接口访问该服务。这个想法是将笔记、日历事件等对象存储在公共层次结构中，并提供用于创建、更新和删除文档的 HTTP 方法，因此这应该是 REST 接口的理想范围。
我的计划是在某个地方有一个 REST 服务器，并且 Web 应用程序在其他服务器上使用数据，因此我需要发出跨域请求，出于安全原因，该请求受到特殊限制（参见例如 本文）。我还想做一些实时更新网络的东西。
现在我一直在做广泛的研究，了解 CORS 是什么并尝试它（使用龙卷风和 jQuery.ajax），但到目前为止，我开始怀疑我的目标设置很快就会实现。我只尝试使用 Firefox（3.6 和 9），但我已经遇到了问题：
- HTTP 身份验证不适用于 jQuery.ajax() （即使设置了 withCredentials）
- 某些浏览器根本不支持 CORS （说 < a href="http://en.wikipedia.org/wiki/Cross-Origin_Resource_Sharing" rel="nofollow">Wikipedia)
- 至少一个 FF 插件 (RequestPolicy) 使 CORS 根本不起作用
我知道 CORS/AJAX 是一个可能的解决方案，但似乎存在太多限制以供实际使用。你们以前做过这种事的人会怎么想：这是我应该做的事情，并希望这些问题将来某个时候能得到解决吗？或者对于跨域 REST/AJAX 方法来说还为时过早？对于上述计划，您会选择什么替代方案？当我开始一个新项目时，我想把它做得干净，没有 JSONP、代理或其他解决方法，但如果没有办法，我还是会这样做。
感谢您的任何答复！
I am writing a REST service that is to be accessed by web applications, desktop clients, mobile clients etc. via a REST interface. The idea is to store objects like notes, calendar events etc. in a common hierarchy and to provide HTTP methods for creating, updating and deleting documents, so this should be the ideal scope for a REST interface.
My plan is to have a REST server somewhere and web applications other servers using the data, so I need to make cross-domain request which are under special restrictions for security reasons (see e.g. this article). I also want to do some real-time updating web stuff.
Now I have been doing extensive research, learning what CORS is and trying it out (with tornado and jQuery.ajax), but by now, I'm getting the suspicion the setup I'm aiming is simply coming to soon. I only tried with Firefox (both 3.6 and 9), but I'm already having problems:
- HTTP authentication does not to work with jQuery.ajax() (even if withCredentials is set)
- some browsers do not support CORS at all (says Wikipedia)
- at least one FF plugin (RequestPolicy) makes CORS not work at all
I understand that CORS/AJAX is a possible solution, but there seem to exist too many restrictions for a practical use. What do you people who did this kind of thing before think: is this something I should just do and hope these problems will be solved by someone sometime in the future? Or is just too soon for the cross-domain REST/AJAX approach? What alternative would you choose for the above plans? As I am starting a new project, I would like to do it clean, without JSONP, proxies or other work-arounds, but if there's no way around, I'd do that anyway.
Thanks for any answers!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
没有什么可以阻止您以标准 JSON 提供响应（例如，对于 CORS 在浏览器中可用的情况），以及在不可用的情况下以 JSONP 提供响应。除了你的输出之外，它不会影响任何东西。
我不会说 CORS 本身是可行的，因为 IE < 8 不支持。我还想说 JSONP 没有任何问题；它是主要参与者使用的技术（Facebook API、Twitter API、Flickr API、Google 的各种 API）。
总之，你说的是对的；目前 CORS 的采用还不够广泛，无法使用。
There is nothing stopping you providing responses in standard JSON (e.g. for instances where CORS is available in the browser), and in JSONP in the cases it isn't. It won't affect anything but your output.
I would not say CORS is viable by itself as IE < 8 does not support it. I would also say that there is nothing wrong with JSONP; it is a technology utilized by major players (Facebook API, Twitter API, Flickr API, Google's various API's).
In short, what you said is correct; CORS is not adopted widely enough at this time to be used.