I just refactored some of my MySpace code this afternoon, to contact an outside server from an OpenSocial app you have to use the makeRequest call, here’s how my makeRequest wrapper looks like:

function makeRequestWrapper(target, callback) {
  try {
    var server_base_url = "http://dev-host.yourdomain.com/myspace"
    var params = {
      METHOD : 'GET',
      AUTHORIZATION : gadgets.io.AuthorizationType.SIGNED
    };
    gadgets.io.makeRequest(server_base_url + target, callback, params)
  } catch(er) {
    console.log(er.message);
  }
}

Here’s how you call this from the MySpace canvas surface:

function submitForm() {
  makeRequestWrapper(
    "/form_submit?" + $("#user_info_form").formSerialize(),
    function (data) {
      submitFormCallback(gadgets.json.parse(data.text));
    }
  )
}

In the userFormCallBack method, you can access the JSON object as arg.foo.

Method to perform makeRequest from the home and profile surfaces (I have no idea why they are different, but this works):

function retrieveHistory() {
  makeRequestWrapper("/show_history",
    function (data) { displayHistory(data); }
  )
}

Notice here you don’t need use data.text like you have to in the canvas surface. I found out that MySpace ignores the request type, on canvas it always returns a JSON object and if your server endpoint returns a JSON encoded object (like with render :json => my_hash.to_json in Rails ), it is stored in data.text, so you have to parse that with gadget.json.parse() to get another JSON object. On the home and profile surfaces it always returns HTML, you can parse the data as it (no need to use data.text), or you can just display the html returned with something like $(“div#blah”).html(data), if you use jQuery.