Hi Alain, perhaps you are not familiar with the restrictions of web browsers. Let me explain:
The traditional mechanism used for making requests is an XMLHttpRequest, which is subject to the same origin policy<http://en.wikipedia.org/wiki/Same_origin_policy>. That means that if your web application is running on example.com, it can only make requests to example.com, not www.google.com, which is where the GData feeds are. With some of the HTML5 technologies that I mentioned, it is possible to make cross-domain requests, though it usually requires some additional engineering work and/or explicit approval by the domain to which requests will be made. I am asking whether www.google.com (or the other domains where GData feeds are) are configured to accept such requests, and if so, using which mechanisms. Further, it is fine to send the OAuth token down to the client (for an authenticated user), but currently, I believe that I need to use the consumer secret to sign GData URLs. That means that an end-user would have to have my secret in order to make a request without the help of my server, which would be a security issue. According to Signing OAuth Requests<http://code.google.com/apis/accounts/docs/OAuth_ref.html#SigningOAuth>, a registered application should sign its requests using its consumer secret. I suppose I could use anonymous/anonymous as if it were an unregistered application, though I'm curious whether my requests would be throttled or anything like that. Though now that I think about it, mobile/desktop applications should be able to use OAuth without going back to the server to sign every request, so there must be a way to do this, but I'm curious what the recommended approach is. --Michael -- You received this message because you are subscribed to the Google Groups "Google Calendar Data API" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://code.google.com/apis/calendar/community/forum.html
