JS Cross-Domain Child to Parent window communication

Question

I'm working on creating an API for my site similar to Facebook Connect. I have a working popup window that works if it is on the same domain as the parent window.

What will be happening though, is users will incorporate my API by including a JS file from my server. When they call the login window, it'll open from their site and allow the user to login on my domain. However, when the user actually logs in, I need to send an event notification to the parent window! As most of you probably know, this cannot happen because these windows are cross domain.

I'm wondering what other current solutions are available for this task. I know if I set the document.domain to be the same on both sites (ie, change the API client's document.domain to my domain - if that's possible?) then the windows can communicate, but I'm not sure that would be at all safe. If the domains can communicate then presumably the API client could wait for the user to open the login window, then read the user's login credentials as they type them in. Is that how it works? Or will they only communicate in one direction?

I'm hoping for a rather simple solution.. But am willing to try out something more complex if need be. I know Facebook is doing it so I know it's possible. Thanks in advance guys.

Answer 1

快速而肮脏的黑客是通过window.name属性发送通知 。