JSONP

JSONP, or JSON-P (JSON with Padding), is a JavaScript technique for requesting data via the HTML element. It was proposed by Bob Ippolito in 2005. JSONP enables sharing of data bypassing same-origin policy, which disallows running JavaScript code to read media DOM elements or XMLHttpRequest data fetched from outside the page's originating site. The originating site is indicated by a combination of URI scheme, hostname, and port number. JSONP requests are vulnerable to the data source replying with malicious code, which is why it has been replaced by CORS (cross-origin resource sharing, available since 2009 ) in modern applications.

JSONP, or JSON-P (JSON with Padding), is a JavaScript technique for requesting data via the HTML element. It was proposed by Bob Ippolito in 2005. JSONP enables sharing of data bypassing same-origin policy, which disallows running JavaScript code to read media DOM elements or XMLHttpRequest data fetched from outside the page's originating site. The originating site is indicated by a combination of URI scheme, hostname, and port number. JSONP requests are vulnerable to the data source replying with malicious code, which is why it has been replaced by CORS (cross-origin resource sharing, available since 2009 ) in modern applications. In this example, the client defined parseResponse as the prepend text. The server response would be: parseResponse({"Name": "Foo", "Id": 1234, "Rank": 7}); Here, parseResponse() is the "P" of JSONP—the "padding" around the pure JSON. $.getScript("http://server.example.com/Users/192.168.73.96?callback=parseResponse"); After the element is injected, the browser evaluates the element, and performs an HTTP GET on the src URL, retrieving the content. Then the browser evaluates the return payload as JavaScript. This is typically a function invocation. In that way, the use of JSONP can allow browser pages to work around the same-origin policy via script element injection. The script runs within the scope of the including page and, as such, is still subject to cross-domain restrictions relative to the domain of the including page. This means that a web page cannot, for example, load a library hosted on another site via JSONP and then make XMLHttpRequest requests to that site (unless cross-origin resource sharing (CORS) is supported), although one could use such a library to make XMLHttpRequests to one's own site.

Text derived from https://en.wikipedia.org/w/index.php?oldid=1372553620 under CC BY-SA 4.0; modifications have been made.