Remote XUL

How to use XUL delivered from a webserver, not as part of chrome.

Note: Support for remote XUL has long been a potential security concern; support for it was disabled in Gecko 2.0. This also means you can't load XUL using file:// URLs unless you set the preference dom.allow_XUL_XBL_for_file to true. However, there is a whitelist that lets you specify sites that can still use remote XUL. The Remote XUL Manager extension lets you manage this whitelist, which is maintained using nsIPermissionManager, by creating entries of type "allowXULXBL", like this:

Components.classes["@mozilla.org/permissionmanager;1"]
                    .getService(Components.interfaces.nsIPermissionManager)
                    .add(uri, 'allowXULXBL', Components.interfaces.nsIPermissionManager.ALLOW_ACTION);

See Using Remote XUL.

OReillyNet Article, Part 1 OReillyNet Article, Part 2

Restrictions

See Remote XUL bugs for needless restrictions, features which don't work in remote XUL (but in chrome XUL) although they really should.