将JSON数据发布到外部URL

Question

How do you post JSON data as a url string to an external url (cross domains) and bypass Access Control?

Here is a jquery .ajax post request that won't work sending to an external url because of Access-Control-Allow-Origin:

var json = JSON.stringify(object);

$.ajax({
  type: 'POST',
  url: externalurl,
  data: json,
  dataType: 'json',
  success: function(data){console.log(data);},
  failure: function(errMsg) {
      console.log(errMsg);
  },
});

I have received a suggestion to POST the data to the same domain and 'pass on the request' to the external domain, though this solution doesn't make sense to me. I am looking for the most secure solution. Any help would be much appreciated.

Answer 1

I did this not too long ago in PHP. Here's an example of "passing the request". (You'll need to enable PHP cURL, which is pretty standard with most installations.)

<?php
    //Get the JSON data POSTed to the page
    $request = file_get_contents('php://input');

    //Send the JSON data to the right server
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "http://location_of_server.com/");
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array("Content-Type: application/json; charset=utf-8"));
    curl_setopt($ch, CURLOPT_POSTFIELDS, $request);
    $data = curl_exec($ch);
    curl_close($ch);

    //Send the response back to the Javascript code
    echo $data;
?>

Answer 2

One way to bypass the Same-Origin policy is to use cURL to do the actual transmitting.

I'll give an example using PHP, but you could easily do this on any server side language.

Set up a script on your server, for example send.php

First you point your ajax to send.php

var json = JSON.stringify(object);

$.ajax({
    type: 'POST',
    url: send.php,
    data: json,
    dataType: 'json',
    success: function(data){console.log(data);},
    failure: function(errMsg) {
        console.log(errMsg);
    },
});

Then your php script to forward it:

<?php
    // Initialize curl
    $curl = curl_init();

    // Configure curl options
    $opts = array(
        CURLOPT_URL             => $externalscriptaddress,
        CURLOPT_RETURNTRANSFER  => true,
        CURLOPT_CUSTOMREQUEST   => 'POST',
        CURLOPT_POST            => 1,
        CURLOPT_POSTFIELDS      => 'field1=arg1&field2=arg2'
    );

    // Set curl options
    curl_setopt_array($curl, $opts);

    // Get the results
    $result = curl_exec($curl);

    // Close resource
    curl_close($curl);

    echo $result;
?>