Is Ajax needed here?

[The Natural Philosopher]

Very simple problem. I want to upload and download data from within a
page to an https socket, to upload and download sensitive data to a
small subwindow. Essentially a password protected javascript driven
<div> element.

i.e. given that I can get my data to a set of javascript variables, I
want to send them to a server side script sitting on the https: part of
a server, and get some other data back into javascript variables. and
hence update the screen.

 

[Legaev Andrey]

If your main page available via http then you will have cross-domain
conflict, i.e. your ajax request won't processed. You will obtain
"Permission denied" exception or similar.

I think you should use general html forms for secure authorization.
May be inside iframe with additional request for checking session
status.

 

[The Natural Philosopher]

If your main page available via http then you will have cross-domain
conflict, i.e. your ajax request won't processed. You will obtain
"Permission denied" exception or similar.

Even if its simply a different socket number on the same machine?

 

[Luke Yan]

Even if its simply a different socket number on the same machine?

right, the protocol, domain and socket port should be same totally.

 

[Legaev Andrey]

This is Same-origin policy. "Domain" in browser's security scheme
meaning is the same protocol+domainname+port group. If you have
different port, different protocol (http -> https) or different domain
(www.domain.com -> my.domain.com) in iframe then script can't access
this content. In the same way you can't send AJAX requests for
different domains.

You can read more at http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy

 

[The Natural Philosopher]

This is Same-origin policy. "Domain" in browser's security scheme
meaning is the same protocol+domainname+port group. If you have
different port, different protocol (http -> https) or different domain
(www.domain.com -> my.domain.com) in iframe then script can't access
this content. In the same way you can't send AJAX requests for
different domains.

Yeah..your answer prompted research..and I realised I had only two
options..either run the main window in https, which I really didn't want
to do, or spawn a new window running https. And pass a cookie across as
a quick marker to show what to display in it.

That's what I have done. Not so slick since it comes with frames bars
and borders that can't be got rid of, but it works.