Secure Cross-Domain Communication: The Architecture Journal

The June issue (Journal 12) of The Architecture Journal focuses on web architecture.  I was delighted to be invited to contribute, and wrote "Secure Cross-Domain Communication in the Browser" for this issue.  In the article I describe a somewhat bizarre technique we use in the Windows Live Contacts web control and Windows Live Spaces web control to move data from HTML pages running on *.live.com to and from third party web sites.  This is how the contacts control returns user-selected contact data to the page hosting the control, a web site that is not a Microsoft site.  

The print edition of Journal 12 is out already and was handed out at TechEd in Orlando earlier this month.  You can request a print copy by registering on the Journal's web site, or you can just grab the PDF and read it on-screen.  Journal 12 will rotate into the headlines on the Journal's homepage soon.

A few posts ago I mentioned I could finally reveal what I had been working on at Google.  Now I can also tell you in exquisite detail what I've been working on here at Microsoft for the past year and foreseeable future:  cross-domain browser communication techniques.  Coaxing stubborn little bits to migrate through impenetrable browser barriers. 

"Secure Cross-Domain Communication in the Browser" is a high-level walk-through of the iframe URL technique of passing information between domain contexts in the browser, it's limitations and weaknesses, and the approach we've taken to build a channel communications library to fortify against those weaknesses and limitations.

Over the next few weeks I will be posting here on Windows Live Quantum Mechanics a series of articles digging into the nitty gritty of cross-domain communication, why it has been taboo in the browser, why it's time to change that perception, and techniques and code you can use today to achieve it - without compromising security or server scalability. 

Cross domain communication would be much easier with the browser's help and shepherding, but with a little bit of effort we can actually do quite a bit today - safely - in spite of the browser's objections.

Comments

• Anonymous
  July 17, 2007
  PingBack from http://www.dotmana.com/index.php/?p=323

• Anonymous
  September 27, 2007
  More than a few blog posts ago I stated my intent to publish a series of articles on cross-domain communication