Ajax Before Ajax: The Hidden Frame
browser wars 1999 partlyLoading data without a page refresh, before XMLHttpRequest: submit to a frame nobody can see, read the answer back out of it.
In 2026: Partly: on an ordinary page the round trip still works, frames and all. In this library's sandbox the hidden frame gets an origin of its own, so the attempt below is refused with a SecurityError, which is its own history lesson: the same-origin wall is exactly what always made this trick so brittle. Microsoft shipped Remote Scripting on a Java applet in 1998, Brent Ashley's JSRS did it with frames alone, and every serious web app of the era had one of these buried in it. XMLHttpRequest retired the genre.
Where it came from: Microsoft Remote Scripting, 1998, and Brent Ashley's JavaScript Remote Scripting, 1999 to 2000. Ajax made the hidden frame a museum piece in 2005.
Wikipedia ↗Wayback: JSRS ↗
<button onclick="fetchViaFrame()">Fetch the price of VRML stock</button>
<p id="out" style="font:13px Verdana"></p>
<script language="JavaScript">
function fetchViaFrame() {
var f = document.createElement("iframe");
f.style.display = "none";
document.body.appendChild(f);
try {
var d = f.contentWindow.document;
d.open();
// In 1999 the frame's src was a CGI URL and the SERVER wrote this script.
d.write("<script>var response = { ticker: 'VRML', price: 0.03 };<\/script>");
d.close();
var r = f.contentWindow.response;
document.getElementById("out").innerHTML =
"The hidden frame answered: " + r.ticker + " at $" + r.price.toFixed(2) +
". Now imagine a server on the other end of it.";
} catch (e) {
document.getElementById("out").innerHTML =
"The frame refused: " + e.name + ". This sandbox gives the hidden frame " +
"its own origin, the same wall that always broke the trick across domains. " +
"Paste the code on an ordinary page and the round trip completes.";
}
}
</script>