AJAX callback?

Developer's Corner General Dev Discussions
#1

I’ve now got my DSC security panel working with a VeraLite thanks to the 2DS plugin. What I’m trying to do is build a separate web interface that will show my security system and the state of all the different zones?this will be AJAX-based to be “real-time”.

In the past, I’ve used JQuery’s $.getJSON function. The webserver is on a separate box, so the Same Origin Policy restriction applies. When I tried the following JQuery call:

$.getJSON("http://192.168.0.22:3480/data_request?id=sdata&output_format=json?callback=?",null,function(data) { ... });

I still get the SOP error.

Does MiOS support callbacks? If so, what URL should I be using? Has anyone else had any success?

My thanks,
J.

#2

Have a look here for some info.

http://wiki.micasaverde.com/index.php/UI_Simple

  • Garrett
#3

Reading through the wiki, I thought I would try the suggested URL (http://192.168.0.22:3480/data_request?id=lu_sdata) rather than the one I was trying (http://192.168.0.22:3480/data_request?id=sdata&output_format=json). Besides the fact that it seems to present identical data, it is also giving me a Same Origin Policy error (even with callback=? appended to the URL).

Am I correct in understanding the simplified lu_sdata does not support JSONP? and that I will instead have to build some sort of poller/cacher that I would call from my JavaScript instead?

#4

Yep.

#5

What would it take from the developers to add CORS (cross-origin resource sharing [url=http://enable-cors.org/server.html]http://enable-cors.org/server.html[/url]) to the built-in webserver? It would be as simple as adding the following header:

Access-Control-Allow-Origin: *
#6

No chance. Also, given MCV’s track record with fixing cross-site scripting bugs, I wouldn’t want it either.

#7

@Juggler, you might want to see my thread here:

http://forum.micasaverde.com/index.php/topic,14066.0.html

I posted some code for a Perl program that is both a Vera client and a Webserver with Websockets / Long-polling Ajax. You could use that to build your custom pages with Jquery.

#8

Thanks for that. I ended up using the following PHP script to deal with the problem.

<?php header('content-type: application/json; charset=utf-8'); header('expires: -1'); header('cache-control: no-cache'); header('pragma: no-cache'); header("access-control-allow-origin: *"); $url = 'http://ip_address_of_veralite:3480/data_request?id=sdata&output_format=json' . http_build_query($_GET); echo file_get_contents($url); ?>

#9

Why couldn’t they just add support for an optional “callback” parameter on the querystring of the “data_request?id=sdata&output_format=json” and similar calls? This doesn’t add any security risk, it just would allow the current JSON to be consumed as a script in a page on a different domain. It would not in anyway allow any other API calls from other domains.

data_request?id=sdata&output_format=json&callback=myfunction

Then the data returned would be the original json wrapped in a function call like this …

myfunction({…original data…})

I cannot for the life of me understand why someone would expose a json data feed without a callback so it could be used as a client side JSONP call instead having to massage it through some server code on another server. There is zero additional security added by leaving this out. On the flipside, not having it makes doing any sort of integration vastly more difficult.

Could someone from the company answer this for me?

#10

I agree with @davidtmills. Without a solution to this, we’re 100% prevented from writing webapps that use the API. This means no Chrome apps/extensions, no Windows 10 apps, no Cordova apps, etc. It may not have been big 4 years ago, but it certainly is now!

#11

[quote=“Juggler, post:8, topic:174511”]Thanks for that. I ended up using the following PHP script to deal with the problem.

<?php header('content-type: application/json; charset=utf-8'); header('expires: -1'); header('cache-control: no-cache'); header('pragma: no-cache'); header("access-control-allow-origin: *"); $url = 'http://ip_address_of_veralite:3480/data_request?id=sdata&output_format=json' . http_build_query($_GET); echo file_get_contents($url); ?>

I ran into the same problem, and ended using a PHP engine on a local webserver. I didn’t need to provide the access-control-allow-origin header in order to do so though.[/quote]

#12

I’m currently looking into lighttpd.conf file accepting allow-cross-origin-response headers and if it would have any effect on the remote requests.

#13

The module needed to do this is not installed on the Vera … At least a year ago …

#14

That stinks…I’m using UI5…is this module still included given the older firmware?

BTW, hi Richard. :slight_smile:

#15

I believe I was looking on the Vera 3 system … If you want to build the OpenWRT system that is compatible with your Vera … you can build your modules … I think it took me a couple of nights to find, downbload, and build these. You need a linux distribution to build the code on … I think I even had to find OLD compilers to match the required development environment, to build the code for a Vera 3 … it’s a pretty old version of OpenWRT. You can find the OpenWRT Version info in a file in the /etc area on your Vera.

#16

While I have a sense of adventure…Sounds like a head ache. lol…I’ll stick to hosting the local web server with php engine to handle the cross origin requests. Its on a inexpensive Raspberry Pi in which is being used as a central control kiosk.

Thanks Richard for the advice. :wink:

#17

You can easily let your Raspberry do a port direct to Vera … (i.e. port 3480 on Raspberry forwards to your Vera) then everything comes from your Raspberry and then you will not have any CORS issue.

#18

So just set Raspberry Pi’s web port to 3480 and that should bypass CORS?

#19

No … you configure the http server on Raspberry to forward port 3480 on the raspberry to your Vera IP Port 3480

#20

Running Abyss Web Server on a lcoal computer and running the script in Chrome did not work out.

—Navigated to http://localhost:3480/trying.html
trying.html:1 XMLHttpRequest cannot load http://192.168.1.102:3480/data_request?id=sdata. No ‘Access-Control-Allow-Origin’ header is present on the requested resource. Origin ‘http://localhost:3480’ is therefore not allowed access.—

I wanted to try it out on my development machine first to see if this would work and it didn’t work out.