AJAX: Accidental (appearance of) cross site scripting caused great confusion.

So, I've working on an AJAX application and the thing works great for 99.9% of my users. Occasionally, a user reports that they click "save" and nothing happens. The "save" in this case is a link that will use AJAX to send the data entered to my server and then the part of the page the user is changing updates after the server successfully updates the DB.

Now, usually, when someone tells me that "nothing happens" I get a little condescending. It's rarely the case that "nothing" happens. Rather, something does happen that, if the user would describe accurately, I might be able to use to analyze and resolve the problem.

In this case, however, I witnessed the problem myself when a recent user shared his screen with me. Sure enough, nothing was happening. I immediately started debugging using FireBug in FireFox. The problem was the same for this user, regardless of which browser and, so far, regardless of which computer he used.

My debugging revealed a greater mystery. Javascript stopped processing every time right where I use the open() method of XMLHTTPRequest (XMLHTTPRequest.open() or, as many libraries do it, xhr.open()). This is even inside of a try/catch section and basically, NOTHING happens.

So, after a few days of dazed confusion, I remembered something that happened when I was still developing my application. If my AJAX call called a domain that was not the same as the domain the web page sits on, NOTHING would happen. No error, no warning, no AJAX call, no nothing. So, I got to thinking about how it might be possible that, for some users on my application, the AJAX call is going out to the wrong domain or something like that.

Finally, a colleague suggested trying, on my own computer, hitting the AJAX thingy while surfing at our domain without the WWW in the address. I tried it. I went to http://mydomain.com and clicked "save" and NOTHING happened. I changed the address in my address bar to http://www.mydomain.com and that fixed it.

Just thought I'd share and save others the trouble.

UPDATE: I use JSMX for my Ajax stuff. It turns out that this problem wouldn't have been so silent if I had noticed and changed the error handler thrown by the open() method. The original developer set up one case as completely silent--interpreting it as an incompatible browser. Without the try/catch, Firefox says "Uncaught exception: Permission denied to call method XMLHttpRequest.open()" when the cross-site scripting is attempted.