GlideAjax and script includes in Development

GlideAjax and script includes

Fetch server data from the browser correctly: AbstractAjaxProcessor, parameters, responses and security.

Quick answer

Fetch server data from the browser correctly: AbstractAjaxProcessor, parameters, responses and security.

Key takeaways

Extend AbstractAjaxProcessor and set type to the class name
Use getXMLAnswer with a callback, not the synchronous variants
Validate parameters and roles inside the method
Return small payloads, JSON strings for anything structured

The server half

Create a script include that extends AbstractAjaxProcessor and tick Client callable. Every method that the browser may call must be listed in the object, and the type property must match the class name.

var IncidentAjax = Class.create();
IncidentAjax.prototype = Object.extendsObject(AbstractAjaxProcessor, {
  getOpenCount: function() {
    var ga = new GlideAggregate('incident');
    ga.addQuery('assignment_group', this.getParameter('sysparm_group'));
    ga.addQuery('active', true);
    ga.addAggregate('COUNT');
    ga.query();
    return ga.next() ? ga.getAggregate('COUNT') : '0';
  },
  type: 'IncidentAjax'
});

The client half

Always use the callback form. Synchronous calls freeze the browser and are the top cause of slow forms.

var ga = new GlideAjax('IncidentAjax');
ga.addParam('sysparm_name', 'getOpenCount');
ga.addParam('sysparm_group', g_form.getValue('assignment_group'));
ga.getXMLAnswer(function(answer) {
  g_form.addInfoMessage('Open in this group: ' + answer);
});

Security

Client callable means anyone who can open a form can call the method with any parameters. Validate inside the method, check roles with gs.hasRole, and never return data the caller could not read through the UI.

Practice challenge

+0 XPStreak ×0

Question 1 of 2

Which parameter names the method to run?

Frequently asked questions

Why does my GlideAjax return nothing?

Nine times out of ten the method is not on a client callable include, sysparm_name does not match a method, or the method returned undefined instead of a string.

Is a client callable script include a security risk?

It is an API endpoint. Treat it like one: check roles, validate input, and return only what the user is allowed to see.