Professional ASP.NET 3.5 AJAX

9.1. The XMLHttpRequest Object

The XMLHttpRequest object was introduced by Microsoft as an ActiveX control for Internet Explorer 5. It was later added to Mozilla 1.0 and Safari 1.2. Internet Explorer 7 includes it as a native script object, rather than as an ActiveX control. Now, all serious browsers include support for this object. In Internet Explorer before version 7, you pass the name of the object to the ActiveXObject function:

var request = new ActiveXObject("Msxml2.XMLHTTP");

In Firefox and most other browsers, you can simply use the new keyword to create an object directly in JavaScript. In these browsers, the XMLHttpRequest has been added natively to the DOM.

var request = new XMLHttpRequest();

The separate implementations have some common methods, and the behavior is much the same, but ASP.NET AJAX provides objects that give you an abstraction from the differences, so you don't have to worry about browser variations. The ASP.NET AJAX Extensions JavaScript objects are also similar to those available in the .NET Framework, so the object model is more familiar to .NET developers than the native XMLHttpRequest objects.

Because ASP.NET AJAX gives you a set of standard classes to ensure consistent behavior when accessing Web resources, rather than using the browser-specific XMLHttpRequest object directly, I won't go into the details of the XMLHttpRequest object, except to point out some security and architectural issues.

9.1.1. XMLHttpRequest Security

The browsers all enforce ...