We have an ASP.Net application hosted on our network and exposed to a specific client. This client wants to be able to import data from their own server into our application. The data is retrieved with an HTTP request and is CSV formatted. The problem is that they do not want to expose their server to our network and are requesting the import to be done on the client side (all clients are from the same network as their server).

So, what needs to be done is:

1. They request an import page from our server
2. The client script on the page issues a request to their server to get CSV formatted data
3. The data is sent back to our application

This is not a challenge when both servers are on the same domain: a simple hidden iframe or something similar will do the trick, but here what I'm getting is a cross-domain "access denied" error. They also refuse to change the data format to return JSON or XML formatted data.

What I tried and learned so far is:

1. Hidden iframe -- "access denied"
2. XMLHttpRequest -- behaviour depends on the browser security settings: may work, may work while nagging a user with security warnings, or may not work at all
3. Dynamic script tags -- would have worked if they could have returned data in JSON format
4. IE client data binding -- the same "access denied" error

Is there anything else I can try before giving up and saying that it will not be possible without exposing their server to our application, changing their data format or changing their browser security settings? (DNS trick is not an option, by the way).