Read an XML in another domain

Question

is it possible to read an xml in another domain? ex:

http://mfmradio.fr/winradio/prog10.xml?player201507291645

did the code:

<script type="text/javascript">
        var i;
        var timer,timeout2;
        $(document).ready(function(){
            LoadProg = function(timeout){
                timeout2 = timeout;
                $.ajax({
                    cache: "false",
                    type: "POST",
                                        url: 'http://mfmradio.fr/winradio/prog10.xml?player201507291645',
                                        dataType: 'xml',
                    success: function(xml, textStatus, XMLHttpRequest){
                        $('#title-list').html('');

                        var pochetteEnCours = $(xml).find('morceau:eq(0)').find('pochette').text();
                        var pochetteEnCours = pochetteEnCours.replace(/^\s+|\s+$/g,"");



                        $('<li class="pochette"><\/li>').html(
                            pochette
                        ).appendTo('#title-list');
                        $('<li class="artiste"><\/li>').html(
                            $(xml).find('morceau:eq(0)').find('chanteur').text()
                        ).appendTo('#title-list');
                        $('<li class="titre"><\/li>').html(
                            $(xml).find('morceau:eq(0)').find('chanson').text()
                        ).appendTo('#title-list');

                        var musiqueEnCours = "J'écoute " + $(xml).find('morceau:eq(0)').find('chanteur').text() + " - " + $(xml).find('morceau:eq(0)').find('chanson').text();
                        $('<iframe allowtransparency="true" frameborder="0" scrolling="no" src="http://platform.twitter.com/widgets/tweet_button.html?via=MFMRadio&amp;text='+musiqueEnCours+'&amp;count=horizontal" style = "width: 110px; hauteur: 20px; position:absolute; margin-top:80px; margin-left:190px;"></iframe>').appendTo('#button_twitter');

                        // Last Titles

                        $('#last-titles-list').html('');
                        $('prog morceau:gt(0):lt(4)', xml).each(function(){

                            var pochetteArchive = $(this).find('pochette').text();
                            var pochetteArchive = pochetteArchive.replace(/^\s+|\s+$/g,"");

                            if( (typeof( pochetteArchive ) != "undefined") && (pochetteArchive != '') ){
                                var pochette = '<img src="' + $(this).find('pochette').text() +'"/>';
                            }else{
                                var pochette = '<img src="/media/pochette.png"/>';
                            }

                            $('<li><\/li>').append(
                                $('<span class="pochette"><\/span>').html(pochette)
                            ).append(
                                $('<span class="artiste"><\/span>').html($(this).find('chanteur').text())
                            ).append(
                                $('<span class="titre"><\/span>').html($(this).find('chanson').text())
                            ).appendTo('#last-titles-list');
                        });

                    }
                });

                timer = setTimeout("LoadProg(timeout2)", timeout);
            }
        });


        $(document).ready(function(){
            LoadProg(20000);
        });


    </script>

But returns the error:

XMLHttpRequest cannot load http://mfmradio.fr/winradio/prog10.xml?player201507291645. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://www.doratiotto.com.br' is therefore not allowed access.

As I do not have access to the domain I could not for example create a crossdomain.xml

Answer 1

It is possible as long as the domain owner allows the request:

PHP:

// Permite apenas alguns domínios
header('Access-Control-Allow-Origin: http://mysite1.com');
header('Access-Control-Allow-Origin: http://example.com');
header('Access-Control-Allow-Origin: https://www.mysite2.com');
header('Access-Control-Allow-Origin: http://www.mysite2.com');

// Permite QUALQUER domínio
header('Access-Control-Allow-Origin: *');  // Permite qualquer domínio

HTACCESS

# Permite alguns domínios
SetEnvIf Origin "^http(s)?://(.+\.)?(domain\.org|domain2\.com)$" origin_is=$0 
Header always set Access-Control-Allow-Origin %{origin_is}e env=origin_is

# Permite QUALQUER domínio
Header set Access-Control-Allow-Origin "*"

I believe that the Access Control comes blocked by default, keep it enabled at any and any occasion would be a security failure.

Example of failure:

Imagine site called faceboock.com and it was just a blank page that requested by AJAX the page of login and changed only the action from the login form to http://faceboock.com/rouba-conta-facebook.php.

Answer 2

If the server http://mfmradio.fr using apache and xml for static, you can use . htaccess with mod_headers, for example:

Header add Access-Control-Allow-Origin "*"

This will allow any external domain to access the .xml, to define a specific domain exchange the * by a url.

---

If you don’t have access to the http://mfmradio.fr, then it will be necessary to create a "proxy" to read this xml, if the server that is ajax is using php, you can use curl, for example:

Create a file called proxy.php:

<?php
if (false === isset($_GET['url'])) {
   echo 'Url não definida';
   exit;
}

$url = $_GET['url'];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_PROXYPORT, 80);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);

$data = curl_exec($ch);
$contentType = curl_getinfo($ch, CURLINFO_CONTENT_TYPE);

header('Content-Type: ' . $contentType);

echo $data;

And in the Ajax should look something like:

$.ajax({
    cache: "false",
    type: "POST",
    url: 'proxy.php?url=' + encodeUri('http://mfmradio.fr/winradio/prog10.xml?player201507291645'),
    dataType: 'xml',