Saxon » SaxonJS

Thanks O'Neil, that's helpful.

I'm not going to try and get around the security issues!

The doc() function will work with the CrossRef API, but other APIs work differently.

For example, Web of Science requires authentication via a HTTP header 'Authorization', which returns a session ID.

Then, a WoS API request requires an HTTP header 'Cookie' with the session ID.

http://wokinfo.com/media/pdf/WebServicesLiteguide.pdf

So I think we need more than the doc() function to access the WoS API.

EXPath looks like it has a feature for this - http://expath.org/modules/http-client/ - but it looks like this is not implemented in Saxon-EE

Also relevant is CORS, see https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS which ought to work with Saxon-JS but I don't think we've actually tried it.

As regards the question,

Is it feasible to include ixsl:schedule-action and HTTP requests in Saxon-EE? (so I'm not tied to using a browser for this)

The answer is yes, it's feasible, but it's significant effort (mainly testing effort). I think we would initially do synchronous HTTP requests only.

Thanks Michael - if it helps, it's the HTTP request (with headers) that I'm interested in, not the asynchronous-ness (-nosity?)

Had a quick go at submitting a "preflight" request:

<xsl:variable name="http-preflight-headers" as="map(*)">
  <xsl:map>
    <xsl:map-entry key="'Access-Control-Request-Method'" select="'GET'"/>
    <xsl:map-entry key="'Access-Control-Request-Headers'" select="'Content-Type'"/>
    <xsl:map-entry key="'Origin'" select="'http://127.0.0.1'"/>
  </xsl:map>
</xsl:variable>

<xsl:variable name="http-preflight" as="map(*)">
  <xsl:map>
    <xsl:map-entry key="'method'" select="'OPTIONS'"/>
    <xsl:map-entry key="'href'" select="'https://doi.crossref.org'"/>
    <xsl:map-entry key="'headers'" select="$http-preflight-headers"/>
  </xsl:map>
</xsl:variable>
                
<ixsl:schedule-action http-request="$http-preflight">
  <xsl:call-template name="handle-preflight-response"/>
</ixsl:schedule-action>

<xsl:template name="handle-preflight-response">
        <xsl:context-item as="map(*)" use="required"/>
        <xsl:message>HTTP response status: <xsl:sequence select="serialize(?status)"/></xsl:message>
        <xsl:message>HTTP response headers: <xsl:sequence select="serialize(?headers)"/></xsl:message>
    </xsl:template>

Got some new error messages, reported by Saxon-JS:

Attempt to set a forbidden header was denied: Origin Attempt to set a forbidden header was denied: Access-Control-Request-Headers Attempt to set a forbidden header was denied: Access-Control-Request-Method

From the research I've been doing re: the same issue, there's no need to do the preflight: your browser will do it automatically when you submit a "complex" request. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS