getify · July 4, 2010 01:54 · getify · Jul 7, 2010 · getify · Jul 7, 2010
diff --git a/api.php b/api.php
 <?php
 // located at:  http://another.tld/auth.php

 $api_callback = $_REQUEST["callback"];

 if ($_COOKIE["token_1"] == "abcd1234" && $_GET["token_2"] == "efgh5678") {
   $msg = "Yes, your API call was successful!";
 }
 else {
   $msg = "API call not authorized.";
 }

 ?>

 // this is a JSON-P style response from the API
 <?=$api_callback?>({"msg": "<?=$msg?>"});
diff --git a/auth.php b/auth.php
 <?php
 // located at:  http://another.tld/auth.php

 $token_1 = "abcd1234";
 $token_2 = "efgh5678";

 $auth_callback = $_REQUEST["callback"];

 setcookie("token_1",$token_1);

 ?>

 // in JS, document.domain is not settable or spoofable so it's 
 // reliable to protect a cross-domain JSON-P call

 if (document.domain == "something.tld") { 
   <?=$auth_callback?>({"token_2": "<?=$token_2?>"});
 }
diff --git a/use_api.js b/use_api.js
 // this file is loaded and run on http://something.tld/index.html

 function make_jsonp_call(url) {
   var script = document.createElement("script");
   script.src = url;
   script.type = "text/javascript";
   document.getElementsByTagName("head")[0].appendChild(script);
 }

 function api_done(resp) {
   alert(resp.msg);
 }

 function get_auth(auth) {
   var token_2 = auth.token_2;

   // not only do we have token_2 by way of the auth parameter,
   // but token_1 is stored in a browser cookie now. together,
   // these two tokens will authorize our API call.

   make_jsonp_call("http://another.tld/api.php?token_2="+token_2+"&callback=api_done");
 }


 make_jsonp_call("http://another.tld/auth.php?key=987654321&callback=get_auth");
	<?php
	// located at: http://another.tld/auth.php

	$api_callback = $_REQUEST["callback"];

	if ($_COOKIE["token_1"] == "abcd1234" && $_GET["token_2"] == "efgh5678") {
	$msg = "Yes, your API call was successful!";
	}
	else {
	$msg = "API call not authorized.";
	}

	?>

	// this is a JSON-P style response from the API
	<?=$api_callback?>({"msg": "<?=$msg?>"});
	<?php
	// located at: http://another.tld/auth.php

	$token_1 = "abcd1234";
	$token_2 = "efgh5678";

	$auth_callback = $_REQUEST["callback"];

	setcookie("token_1",$token_1);

	?>

	// in JS, document.domain is not settable or spoofable so it's
	// reliable to protect a cross-domain JSON-P call

	if (document.domain == "something.tld") {
	<?=$auth_callback?>({"token_2": "<?=$token_2?>"});
	}
	// this file is loaded and run on http://something.tld/index.html

	function make_jsonp_call(url) {
	var script = document.createElement("script");
	script.src = url;
	script.type = "text/javascript";
	document.getElementsByTagName("head")[0].appendChild(script);
	}

	function api_done(resp) {
	alert(resp.msg);
	}

	function get_auth(auth) {
	var token_2 = auth.token_2;

	// not only do we have token_2 by way of the auth parameter,
	// but token_1 is stored in a browser cookie now. together,
	// these two tokens will authorize our API call.

	make_jsonp_call("http://another.tld/api.php?token_2="+token_2+"&callback=api_done");
	}


	make_jsonp_call("http://another.tld/auth.php?key=987654321&callback=get_auth");