Since it uses an iframe, it'll be interesting to know what happens on a site that detects that.
edit: It's fixed now, that's what I get for not reading the removeEventListener docs.
We experimented with something similar a while ago, but found that creating and destroying all those iframes could slow down older browsers. (Our use case potentially required sending requests relatively frequently.) Have you observed anything like that with this technique?
Honestly, flash might be the best solution for something like you're talking about. I was just going for something with almost no dependencies that was stupidly simple.
This whole thing isn't an issue any longer if the server containing the secret data is expecting random people to access it and implements auth with something more than cookies. Take a look at Twitter and Facebook. They both allow cross-domain requests.
janky.post will only work if the server is expecting the request (it won't allow arbitrary requests to anything on the remote server) and then, it's up to the remote site's engineers to make these endpoints secure.
I mean really: creating hidden iframes with onload actions that post to another domain. I don't know whether to be proud of our ingenuity or sad that this is the cutting edge of interprocess communication for the web.
