MODx acting as proxy for remote feed - problems/suggestions?

Hi,

I have written a snippet that can take a remote XML file and process it using a local XSL transformation. At the moment the transformation happens on the server. However, I would like it to be able to handle another case where the transformation happens in the browser using Javascript. I have encountered a problem with this senario thought. It appears that the Firefox default security settings won’t allow a XMLHttpRequest object to get a XML file from a different domain that the one the javascript code is on, thus it couldn’t be used to get remote news feeds. I have read on the internet that setting up some sort of proxy to do this is a possibility: the MODx system will retrieve the remote feed, which is accessible to the browser at the same domain as the main site with the javascript code.

I think I could set up a page that does just act as proxy to another page on the internet - where the calls to www.mydomain.com/myproxy?url=www.otherdomain.com/feed.xml would return the contents of www.otherdomain.com/feed.xml to the requesting client. However - I don’t think it would be a good idea to allow the server to be a proxy to anyone wanting any page from the internet. I’m not sure how to limit it to people accessing it through the plugin. Does anyone have any suggestions? Could there be any other problems with doing something like this?

Thanks,

Michal.

First you could just write a simple php script that gets the XML and then uses the passthru() function to return the XML file. It’s much quicker and easier to do this kind of thing outside of MODx IMO.

Next only allow requests with the file names that match the names of the files you want to allow. An alternative approach would be to use IDs instead of filenames. For example:

http://www.mysite.com/phpproxy.php?id=5

to get the XML resource you have decided has the ID of 5. No one else will know what that relates to, and will make the script look very specific rather than general purpose.

Andy

Hi.

Thanks for your reply.

I think I would probably be able to do something like you suggest. I’m not sure about the passthru() function though, but a PHP script that gets the XML file I could write using the CURL functions. How would you do it with passthru()?

However, in order to do this, it seems as though there would have to be editing of the PHP file for each XML resource used. I would prefer to have a nice easy to use snippet that could be used for any remote XML feed, that does not require editing of PHP files. It looks to me as though the snippet call would have to save the URL of the XML feed somewhere (a file or the database?) and then the proxy script would have to check if the requested URL is allowed. This seems a bit overly complicated to me though! Could there be an easier way?

Also, this doesn’t check that the client that requests the remote feed is in fact coming from my website. Is there some way (perhaps with cookies/referer in http header) to make sure that they are?

Michal.

There are lots of ways to skin this cat, so take your pick. The best solution depends on your requirements.

Andy