host page. The origin in this case is defined by the
location of the containing page. Therefore, even if we
have to load multiple components from various ori-
gins, the files will eventually run in the origin of the
page that includes them. The biggest problem with
this scenario is the possible use of mixed content in
the case of files coming from both secured (HTTPS)
and non-secured (HTTP) origins. Behaviour in this
case is browser-dependent and typically problematic.
Another problem is that code, regardless of origin,
will run under the same context as a single-threaded
application. Performance-wise this is not desirable.
The third issue is code organisation. Intermixing code
from different sources in the same global namespace
is a potential risk. Accidental name clashes that inval-
idate data are not uncommon problems in this case. In
conclusion this method is obviously not an option.
Another method for performing cross-origin
requests is JavaScript Object Notation with
Padding (JSONP). This is essentially a hack based
on the premise that JavaScript code referenced di-
rectly from a page, eventually runs in the origin of
that page. This method presupposes a great deal of
control over the component source and JSONP-aware
services. It also suffers from most of the problems
mentioned above. For these reasons this approach is
inadequate for our purposes. A third method (that is
also a hack) is to circumvent the policy by not mak-
ing any cross-origin requests at all. This apparently
requires an extra logical tier in the system that re-
sides at the server side. Requests are sent to a server-
side proxy that has the same origin as the page. This
approach is cleaner than the previous ones but re-
quires an extra server-side component which makes
it somewhat cumbersome. Another alternative is
to use Cross-origin Resource Sharing (CORS).
The assumption again is that we have access over
the server processes and we can overcome SOM by
adding an HTTP header in the response. This header
can then instruct the browser not to consider the call
a SOM violation. Apart from the previously men-
tioned issues, this approach has the additional prob-
lems of potential browser incompatibility and header
removal by firewalls. Modern browsers have the abil-
ity to bypass SOP by making calls to WebSocket ad-
dresses. In this case it is the WebSocket server that
does the security checks and allows the caller to re-
ceive an answer or not. Server dependencies and other
obvious problems make this approach equally inade-
quate as the above. A fifth method is to use iframes
by explicitly declaring in JavaScript that the nodes
have the same origin. This can be done by setting
the property document.domain to the same domain
name at both ends. A system called Subspace (Jack-
son and Wang, 2007) is using this technique to imple-
ment cross-domain communication for web mashup
applications. The actual behaviour depends on the
browser and another problem is that resetting the do-
main property may not have the expected result. A
typical problem is that the port number may be set
to null (empty) by that process. Implementation is
again browser-dependent.
The only method that overcomes all of the above
obstacles is to embed the component in a sandbox
and communicate through HTML5 messaging. In
HTML terms this can be a common iframe element
that hosts a separate page containing the external li-
brary. The component is kept isolated in the sandbox
and executes in its own context as a separate applica-
tion. That provides the advantages of code safety and
parallel execution. The component interoperates with
its host through a messaging system inherently sup-
ported by HTML5 (J
¨
arvinen, 2011). Concurrency is
maintained by asynchronous message passing at ei-
ther direction. Execution and data interchange take
place entirely in the browser and there is no network
and server overhead involved.
3.2 Interfacing
As explained above, node diversity is hidden within a
wrapper. The wrapper provides a very generic inter-
face through which basic communication can be car-
ried out. The interface comprises the following two
functions:
• sendMessage(message)
• receiveMessage(event)
This system provides the ability for two-way com-
munication between the host and the guest. In both
cases the data is sent in the form of a message ob-
ject. The only difference is that in the latter case the
message is received as a property of an event object.
Message passing in the HTML5 system is carried out
using events.
The format of the message object follows:
• origin: This property serves as the unique identi-
fier of the component that sends the message. It is
not the same as the homonymous property of the
event object that carries it when in transit. The lat-
ter corresponds to the domain of the sender. This
property is just some text that uniquely identifies
the component in the system.
• content: This property can contain data of any
type. The purpose in this case is to send some
data and let the receiver decide what to do with it.
KEOD 2015 - 7th International Conference on Knowledge Engineering and Ontology Development
142