Differences

This shows you the differences between two versions of the page.

--- 4thefile_api [2010/11/05 16:43] – jay
+++ 4thefile_api [2010/11/08 21:53] (current) – jay
@@ Line 2: / Line 2: @@
 The 4theFile API provides RESTful web services for use in integrating 4theFile with other web-based applications. The API has the following features:
   * all communication via HTTP or HTTPS
   * authentication via HTTP Basic auth
@@ Line 13: / Line 14: @@
 ===== Synopsis =====
-  - A 4theFile Collection provides a custom email address for an area of your site. This collection is owned and controlled by you, and there's no need for your users to become registered 4theFile users.
+  - A 4theFile Collection provides a custom email address for submitting emails to a functional area of your site. The Collection is owned and controlled by you, and there's no need for your users to become registered 4theFile users.
-  - The 4theFile API allows you to integrate the list of emails submitted to the custom address into your site's interface, while avoiding all the messy issues usually associated with email integration.
+  - The 4theFile API allows you to integrate the list of emails submitted to the Collection into your site's interface, while avoiding all the messy issues usually associated with email integration.
 ===== Example Use Case =====
@@ Line 59: / Line 60: @@
 Undoubtedly there are uses of the 4theFile API we haven't thought of. If there's a need for delegated authorization for access to data not owned by the API client account, we'll support OAuth in the future. If you are an application developer or maintainer and have an idea for using the API to access 4theFile end-user data, please let us know. //Please do NOT ask your users to give you their 4theFile passwords or apiKeys!//
+===== Use with AJAX =====
+If your web application's interface uses AJAX, you might be thinking that you can call the 4theFile API to get a 4theFile resource list in json format directly from inside the browser via XMLHttpRequest. There are 2 reasons why this isn't a good idea:
+  - your browser probably won't allow it, because you're violating the "same origin" policy that helps prevent malicious cross-site scripting (XSS) attacks
+  - you would need to provide access to your API credentials in the client-side javascript, thereby exposing them in the client-side source code
+So, you'll need to provide your own ajax callback that in turn calls the 4theFile API from the server, or else provide a web proxy in the same origin as your server as described here http://developer.yahoo.com/javascript/howto-proxy.html
+Note: If you've read this far, you may be familiar with JSONP (an alternate solution to cross-domain ajax problems). We'd probably be willing to support JSONP as an alternative response format in the future if there's any demand for it. So if you'd like JSONP, [[tech_support_contacts | let us know]].

4theFile Support Wiki

User Tools

Site Tools

Differences

Page Tools