---
title: Cross Domaining
description: The following article is provided on an advice basis only.  Due to the varied nature of load balancers and their configuration Push Technology are unable to provide further support.
---

[Skip to content](https://support.diffusiondata.com/knowledge/cross-domaining#main-content)

English

Show submenu for translations

[Contact Customer Support](https://support.diffusiondata.com/knowledge/kb-tickets/new?hsLang=en) [Customer portal](https://support.diffusiondata.com/tickets-view?hsLang=en)

[![DiffusionData Logo](https://support.diffusiondata.com/hs-fs/hubfs/DiffusionData-Logo-Primary-Trimmed.png?width=445&height=64&name=DiffusionData-Logo-Primary-Trimmed.png)](https://www.diffusiondata.com)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Contact Customer Support](https://support.diffusiondata.com/knowledge/kb-tickets/new)
- [Customer portal](https://support.diffusiondata.com/tickets-view)

 How can we help you?

- There are no suggestions because the search field is empty.

1. [Help Center](https://support.diffusiondata.com/knowledge?hsLang=en)
2. [Administer](https://support.diffusiondata.com/knowledge/administer?hsLang=en)

# Cross Domaining

**The following article is provided on an advice basis only. **  
**Due to the varied nature of load balancers and their configuration Push Technology are unable to provide further support.**

### Problem

The Diffusion Javascript Client Library, unless otherwise configured, will cascade downward through a set of ‘transports’ starting with WebSockets and working it’s way down toward XmlHttpRequest (‘XHR’ or ‘Ajax Long Poll’), and then finally to hidden IFrames.

Websockets, Flash and Silverlight have few security constraints, however XHR is subject to the same origin policy (external site). Simply put, if Javascript code executes within a web page sourced from [www.pushtechnology.com](http://www.pushtechnology.com/) then it is only permitted to make XHR requests back to www.pushtechnology.com. If your diffusion server is at [example.pushtechnology.com](http://example.pushtechnology.com/) this presents a problem when only XHR is available.

### Resolution

#### CORS Solution

[Cross-Origin Resource Sharing](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) (external site), is a standard formed to address circumstances where[www.pushtechnology.com](http://www.pushtechnology.com/) uses XHR to access resources on alternate host [example.pushtechnology.com](http://example.pushtechnology.com/), and aims to provide sensible constraints and avoid a free-for-all.

CORS uses HTTP headers to enable the Diffusion server to indicate if it accepts traffic from web pages served from other servers. When a CORS request is made, Diffusion must respond with certain response HTTP headers for the browser to treat the request as successful. CORS requests can result in the browser sending a pre-flight request to Diffusion using the OPTIONS method to determine if the origin, headers, and methods of the request it is about to make are permitted. Diffusion responds with the correct values for headers and methods but the actual request is not made until the pre-flight request succeeds.

The allowed origins can be configured in the client-service element of the WebServer.xml configuration file.

#### Client Side

To enable CORS in the JavaScript client, include the XHRURL attribute in the arguments to the[DiffusionClientConnectionDetailsconstructor](http://docs.pushtechnology.com/docs/latest/?page=docs.pushtechnology.com/docs/latest/js/symbols/DiffusionClientConnectionDetails.html).

```
var connectionDetails = {	debug : true,	onDataFunction : onDataEvent,	XHRURL: "http://www.pushtechnology.com:8080"",}
```

#### Server Side

CORS filtering is governed on the server side using the cors-origin attribute found in etc/WebServer.xml.

By default this is a very permissive .\* regular expression, and must be set to something more specific in production. In the above example, [push.example.com](http://push.example.com/) will limit requests to [push.example.com](http://push.example.com/) to only those from [www.example.com](http://www.example.com/). Full details about this feature are found in the web server section of the Diffusion manual.

#### CORS Limitations

Full CORS support has only been available in Internet Explorer 10+.

The full CORS support table is available at the following link:

- [Cross-Origin Resource Sharing](http://caniuse.com/#feat=cors) – Support Table (opens in new window – external site)

Due to the lack of CORS support in some browsers it is recommended that a load balancer solution is used instead, as this is a catch all solution irrespective of web browser used.

#### Load Balancer Solution

Rather than catering to each special case browser, this approach contains all complexity to one place. This solution presumes that a load balancer is already in place.

All XHR requests to Diffusion use a URL that starts with /diffusion. Routing all such requests to one of the servers in the Diffusion pool will make available both regular and Diffusion functionality from one apparent host.

![article6\_image1](https://support.diffusiondata.com/hs-fs/hubfs/article6_image1.png?width=688&height=433&name=article6_image1.png)

In circumstances where clients of Diffusion solutions cannot be depended upon to have a single IP address (for example: users with multiple aDSL connections, or smart-phones migrating between providers), each HTTP request made from a Diffusion client to a Diffusionserver holds a cookie named “session” holding the unique client-id of that client. This gives load balancers an alternative means of distributing a request to one of their Diffusion server team.

- [Administer](https://support.diffusiondata.com/knowledge/administer?hsLang=en)
- [Build](https://support.diffusiondata.com/knowledge/build?hsLang=en)
- [Getting Started](https://support.diffusiondata.com/knowledge/getting-started?hsLang=en)
- [Install & Upgrades](https://support.diffusiondata.com/knowledge/install-upgrades?hsLang=en)
- [Management & Monitoring](https://support.diffusiondata.com/knowledge/management-monitoring?hsLang=en)
- [Security](https://support.diffusiondata.com/knowledge/security?hsLang=en)
- [Support](https://support.diffusiondata.com/knowledge/support?hsLang=en)
- [Troubleshooting](https://support.diffusiondata.com/knowledge/troubleshooting?hsLang=en)
- [Cloud](https://support.diffusiondata.com/knowledge/cloud?hsLang=en)

[![Chill listening crop-3](https://support.diffusiondata.com/hs-fs/hubfs/DiffusionData%20Favicon.png?width=24&height=24&name=DiffusionData%20Favicon.png "Chill listening crop-3")](http://diffusiondata.com)

diffusiondata.com Help Center

Copyright © 2026, DiffusionData