title: Cross-Origin resource sharing and file://
body: <p>I am writing an HTML5 application that is gathering data from a few different sources using JSONP.  Anything I'm doing with a GET works perfectly.  I'm now trying to POST data, and I've run into an interesting snag.  I need to POST data from my application to another, where my application is running from a local machine.  I am trying to write a cross-platform capable mobile application (think Pulse/Flipboard), so the code will always be running from a local source.  My thought process was as follows:</p>
  
  <ul>
  <li>Use JSONP - JSONP does not allow for posting, it just doesn't work that way (<a href="https://stackoverflow.com/questions/2699277/post-data-to-jsonp">Post data to JsonP</a>)</li>
  <li>Rely on CORS - Since the request is coming from a local source using <code>file://</code>, the origin header is null.  This causes the request to fail (<a href="https://stackoverflow.com/questions/3595515/xmlhttprequest-error-origin-null-is-not-allowed-by-access-control-allow-origin">XmlHttpRequest error: Origin null is not allowed by Access-Control-Allow-Origin</a>)</li>
  <li>Use another server to bounce the request off of - this would be expensive</li>
  </ul>
  
  <p>All of the browsers I'm targeting are webkit based (iPad, Playbook, Android), so I'm wondering if there are any creaks in the same origin policy code that I can sneak through?  Maybe something using iframe or postMessage?</p>