Does Google not accept ajax in Spreadsheets?

Question

I'm trying to get data both with JQuery .get and XmlHttpRequest, but it seems both of them fail.

I'm trying to do this in a modal dialog I created in the spreadsheet.

Is there anything wrong, or any procedure I must do before trying?

---

Details:

1 - Modal Dialog is working (the messages I put before the ajax code are shown fine, the messages after the .get are also fine.
2 - I know google UrlFetch in the server-side, but I'm interested only in the client-side now.

---

Code:

1 - Jquery get:

alert("test");

$.get("http://www.w3schools.com/jquery/demo_test.asp", function(data,status){
            alert(status + " /// " + data); //never shown

    });

alert("after get"); //shown

2 - HttpRequest:

var Req = new XMLHttpRequest();
var URL2 = "http://www.w3schools.com/ajax/ajax_info.txt";
Req.open('GET', URL2, false);
alert("Got2");
Req.send();
alert("sent2");  //never shown 
alert(Req.responseText); //never shown

Answer 1

I assume you are using custom HTML code in the modal dialogs?

There's no problem with your Javascript code as far as I can tell, but your XMLHttpRequest (and in turn the JQuery.get, since that relies on XMLHttpRequest interally) are failing because of permissions problems. You can see the errors in the developer console of your browser.

First, Google Spreadsheets is loaded using HTTPS, and (at least for Chrome where I tested) you are not allowed to load an insecure HTTP resource from a HTTPS page via XMLHttpRequest (the idea is that, if the endpoint is insecure, then you cannot guarantee that whatever data you obtain via XMLHttpRequest is not something that a malicious attacker has inserted, instead of the actual data).

Second, XMLHttpRequest restricts you to only the same domain, by default. This means that you can only access resources on the domain [some random string].googleusercontent.com where the script code is loaded from. To perform XMLHttpRequest to another domain (called cross-origin XMLHttpRequest) the server providing the resource must send special HTTP headers indicating that the server permits such a cross-origin access. More details here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS. Thus unless the w3schools server sends the correct headers, you can't use XMLHttpRequest on those URLs.

Thus if you want to access the resource, you probably need to ensure it is served over HTTPS and sending the correct headers. An example of a resource that does both the above correctly is the Yahoo Query Language endpoints. Using the following URL will work, for example:

https://query.yahooapis.com/v1/public/yql?q=select%20*%20from%20html%20where%20url%3D'http%3A%2F%2Fen.wikipedia.org%2Fwiki%2FYahoo'%20and%20xpath%3D'%2F%2Ftable%2F*%5Bcontains(.%2C%22Founder%22)%5D%2F%2Fa'&format=json&env=store%3A%2F%2Fdatatables.org%2Falltableswithkeys

Alternatively, just access the resource using Google's servers via UrlFetch!