Third-Party JavaScript

377 Pages·2013·6.78 MB·English

by  Ben Vinegar

Third-Party JavaScript
Ben Vinegar & Anton Kovalyov
Copyright
For online information and ordering of this and other Manning books, please
visit www.manning.com. The publisher offers discounts on this book when
ordered in quantity. For more information, please contact
Special Sales Department
Manning Publications Co.
20 Baldwin Road
PO Box 261
Shelter Island, NY 11964
Email: [email protected]
©2013 by Manning Publications Co. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or
transmitted, in any form or by means electronic, mechanical, photocopying, or
otherwise, without prior written permission of the publisher.
Many of the designations used by manufacturers and sellers to distinguish their
products are claimed as trademarks. Where those designations appear in the
book, and Manning Publications was aware of a trademark claim, the
designations have been printed in initial caps or all caps.
Recognizing the importance of preserving what has been written, it is
Manning’s policy to have the books we publish printed on acid-free paper, and
we exert our best efforts to that end. Recognizing also our responsibility to
conserve the resources of our planet, Manning books are printed on paper that is
at least 15 percent recycled and processed without the use of elemental chlorine.
Manning Publications Co. Development editor: Renae Gregoire
20 Baldwin Road Technical proofreaders: Alex Sexton, John J. Ryan III
PO Box 261 Copyeditor: Benjamin Berg
Shelter Island, NY 11964 Proofreader: Katie Tennant
Typesetter: Dottie Marsico
Cover designer: Marija Tudor
Printed in the United States of America
1 2 3 4 5 6 7 8 9 10 – MAL – 18 17 16 15 14 13
Brief Table of Contents
Copyright
Brief Table of Contents
Table of Contents
Foreword
Preface
Acknowledgments
About this Book
About the Authors
About the Cover Illustration
Chapter 1. Introduction to third-party JavaScript
Chapter 2. Distributing and loading your application
Chapter 3. Rendering HTML and CSS
Chapter 4. Communicating with the server
Chapter 5. Cross-domain iframe messaging
Chapter 6. Authentication and sessions
Chapter 7. Security
Chapter 8. Developing a third-party JavaScript SDK
Chapter 9. Performance
Chapter 10. Debugging and testing
Index
List of Figures
List of Tables
List of Listings
Table of Contents
Copyright
Brief Table of Contents
Table of Contents
Foreword
Preface
Acknowledgments
About this Book
About the Authors
About the Cover Illustration
Chapter 1. Introduction to third-party JavaScript
1.1. Defining third-party JavaScript
1.2. The many uses of third-party JavaScript
1.2.1. Embedded widgets
1.2.2. Analytics and metrics
1.2.3. Web service API wrappers
1.3. Developing a bare-bones widget
1.3.1. Server-side JavaScript generation
1.3.2. Distributing widgets as iframes
1.4. Challenges of third-party development
1.4.1. Unknown context
1.4.2. Shared environment
1.4.3. Browser restrictions
1.5. Summary
Chapter 2. Distributing and loading your application
2.1. Configuring your environment for third-party development
2.1.1. Publisher test page
2.1.2. The web server
2.1.3. Simulating multiple domains
2.2. Loading the initial script
2.2.1. Blocking script includes
2.2.2. Nonblocking scripts with async and defer
2.2.3. Dynamic script insertion
2.3. The initial script file
2.3.1. Aliasing window and undefined
2.3.2. Basic application flow
2.4. Loading additional files
2.4.1. JavaScript files
2.4.2. Libraries
2.5. Passing script arguments
2.5.1. Using the query string
2.5.2. Using the fragment identifier
2.5.3. Using custom data attributes
2.5.4. Using global variables
2.6. Fetching application data
2.7. Summary
Chapter 3. Rendering HTML and CSS
3.1. Outputting HTML
3.1.1. Using document.write
3.1.2. Appending to a known location
3.1.3. Appending multiple widgets
3.1.4. Decoupling render targets
3.2. Styling your HTML
3.2.1. Using inline styles
3.2.2. Loading CSS files
3.2.3. Embedding CSS in JavaScript
3.3. Defensive HTML and CSS
3.3.1. Namespaces
3.3.2. CSS specificity
3.3.3. Overspecifying CSS
3.4. Embedding content in iframes
3.4.1. Src-less iframes
3.4.2. External iframes
3.4.3. Inheriting styles
3.4.4. When to refrain from using iframes?
3.5. Summary
Chapter 4. Communicating with the server
4.1. AJAX and the browser same-origin policy
4.1.1. Rules for determining same origin
4.1.2. Same-origin policy and script loading
4.2. JSON with padding (JSONP)
4.2.1. Loading JSON via script elements
4.2.2. Dynamic callback functions
4.2.3. Limitations and security concerns
4.3. Subdomain proxies
4.3.1. Changing a document’s origin using document.domain
4.3.2. Cross-origin messaging using subdomain proxies
4.3.3. Combining subdomain proxies with JSONP
4.3.4. Internet Explorer and subdomain proxies
4.3.5. Security implications
4.4. Cross-origin resource sharing
4.4.1. Sending simple HTTP requests
4.4.2. Transferring cookies with CORS
4.4.3. Sending preflight requests
4.4.4. Browser support
4.5. Summary
Chapter 5. Cross-domain iframe messaging
5.1. HTML5 window.postMessage API
5.1.1. Sending messages using window.postMessage
5.1.2. Receiving messages sent to a window
5.1.3. Browser support
5.2. Fallback techniques
5.2.1. Sending messages using window.name
5.2.2. Sending messages using the URL fragment identifier
5.2.3. Sending messages using Flash
5.3. Simple cross-domain messaging with easyXDM
5.3.1. Loading and initializing easyXDM
5.3.2. Sending simple messages using easyXDM.Socket
5.3.3. Defining JSON-RPC interfaces using easyXDM.Rpc
5.4. Summary
Chapter 6. Authentication and sessions
6.1. Third-party cookies
6.1.1. Setting and reading sessions
6.1.2. Disabling third-party cookies
6.1.3. Internet Explorer and P3P headers
6.1.4. Detecting when cookies are unavailable
6.2. Setting third-party cookies
6.2.1. Using dedicated windows
6.2.2. Iframe workaround (Safari only)
6.2.3. Single-page sessions for Chrome and Firefox
6.3. Securing sessions
6.3.1. HTTPS and secure cookies
6.3.2. Multilevel authentication
6.4. Summary
Chapter 7. Security
7.1. Cookies, sessions, and session theft
7.2. Cross-site scripting
7.2.1. XSS attacks
7.2.2. XSS vulnerabilities in CSS
7.2.3. Defending your application against XSS attacks
7.3. Cross-site request forgery
7.3.1. XSRF attacks
7.3.2. JSON hijacking
7.3.3. Defending your application against XSRF attacks
7.4. Publisher vulnerabilities