I've read some unofficial things online that using the Javascript client object model to retrieve content from other site collections is not allowed due to prevent the equivalent of "cross site scripting attacks". For example, if I wanted to access some list items from one site collection, and display them in another, I cannot do so.
I tried a simple example and I got the "The security validation for this page is invalid." error message (see end of post for simple example).
Is it true that you cannot go across site collections (assuming user has permissions in both)? If so, where is this called out? All the MSDN/SDK examples make it appear as though you can go across site collections...
<script type="text/javascript">
var foo = ExecuteOrDelayUntilScriptLoaded(loadView, "sp.js");
function loadView(){
var siteUrl = '/sites/AnotherSiteCollection'
var ctx = new SP.ClientContext(siteUrl);
this.web = ctx.get_web();
var lists = web.get_lists();
var list = lists.getByTitle("Shared Documents");
var views = list.get_views();
this.View = views.getByTitle("All Documents");
this.ViewAsHtml = this.calendarView.renderAsHtml();
ctx.load(this.calendarView);
ctx.executeQueryAsync(Function.createDelegate(this, this.success), Function.createDelegate(this, this.failure));
}
function success() {
$get("viewContainer").innerHTML = this.ViewAsHtml.get_value();
}
function failure(sender, args) {
alert('Request failed. ');
alert( args.get_message());
}
</script>
<div id="viewContainer" > </div>