Few months ago, I had a chat with my colleagues about dashboards. How useful it would be for developers if they have a [tag]dashboard[/tag]? – a centralized source of information that they need for day-to-day work (i.e. assigned issues in the bug tracking system, modifications in the company’s wiki, changes in the version control system etc.). We’ve also noticed that [tag]iGoogle[/tag] ([tag]Google Personalized Homepage[/tag]) was becoming more and more popular. It could have been the ideal dashboard. The problem was that all our systems are accessible only from intranet and there was no [tag]gadget[/tag] that could read/display them. In this blog I am going to show an [tag]intranet[/tag] [tag]feed reader[/tag] that overcomes these issues.
Problem 1 – gadget API
Google Gadgets API cannot fetch intranet feeds (even if the gadget runs on a browser inside the intranet, Google uses its own servers to fetch and process the data as can be seen in Figure 1.)
Figure 1. Google gadget – intranet feeed reader – request flow.
Use third party library to fetch the data, this means that the request will be issued from our browser (instead of Google’s servers). Another solution would be to use gadget with content of type ‘url’ pointing to some intermediate (proxy) server that renders the whole gadget.
Problem 2 – cross-domain scripting
If some third party library is used (like jquery, prototype, dojo etc.) for content fetching we’ll run into cross-domain scripting problem (the gadget is served by Google, our feeds are on our intranet) Browser doesn’t allow ajax calls to different domains. How to avoid the same-origin policy?
Solution 2 – jsonp
Following options are available:
- Make the feed output jsonp instead of XML (this can be done if we have control over the feed)
- use flash to fetch the feed
- use a local proxy, in this case a xml2jsonp proxy
- digitally sign you scripts – works only in Firefox
- (cross-document messaging in upcoming HTML 5.0)
I’ll focus on the third option. Following figure gives an overview of the request flow:
Figure 2. Google gadget – intranet feeed reader – solution – using xml2jsonp proxy.
As can be seen in Figure 2. the client retrieves the gadget and then issues a JSONP cross-domain request. Browser allows it because in this case it is an ordinary <script> request that isn’t restricted by the same-origin policy.
Figure 3. Example screenshot.
Gadget source code is retrieved from Google servers (or you can host it yourself for more control). All further communication is done within intranet. It is susceptible to all threats as any other intranet traffic. You can view the source code of the gadget and make sure that it is not sending your data where is shouldn’t be.
If feeds require authentication the gadget has to be configured with this information (cookies, url parameters). Please note that when the page on which a gadget appears is viewed, a request is sent to Google’s servers that include the gadget’s URL and the gadget preferences selected, as well as the URL of the page.
The intranet feed reader gadget can be used as part of a developer’s dashboard. It can display any intranet feed. Most useful might be information necessary for day-to-day work (e.g. current assigned issues in the bug tracking system, changed resources in company’s wiki or version control system).
Update (27. May 2008):
Mihailo Lalevic ported this Intranet Feed Reader to Firefox – as a Firefox add-on. More information can be found in his blog.