Using an embedded VF to bypass issues with CORS and connect to a websocket server and bubble up events into the parent container.
-
On the back of fantastic work by Christophe Coenraets: https://developer.salesforce.com/blogs/developer-relations/2015/11/create-lightning-component-drag-drop-profile-pictures.html
-
And also the discussion at: http://salesforce.stackexchange.com/questions/55306/how-to-call-a-salesforce-rest-url-from-lightning-component