Contents
Why to avoid JSONP in web application?
Security risk JSONP makes it possible to access data from another website. This makes it possible to retrieve personal data from a logged-in user. If the data is specific to the user, or can only be accessed by an authenticated user, other sites should not have access to it.
How do I use Jsonp?
Method to use JSONP: The web services allow to specify a callback function. In the URL include the callback parameter in the end. When the browser comes across the script element, it sends HTTP request to the source URL. The server sends back the response with JSON wrapped in a function call.
How does Google Analytics use a JSONP request?
These days Google Analytics uses a JSONP request to load ga.js into user’s web pages via a callback function. According to the Wikipedia, JSONP can “inject any content into a website.”
Are there any security issues with using JSONP?
There are security issues for both sides. The most serious one is for the site including JSONP. If you are including a from another domain (which you do not control), that domain can change up the script at any time. They can make the javascript do anything in the context of your webpage, that your own javascript could do.
Is it safe to use script referencing in Google Analytics?
When using a Google product, you will be pretty safe including the script referencing – so there is little requirement for this to be done in a different manner. However, having script references to lesser known entities whose security might not be quite upto the standard of Google’s may be of cause for concern.
Is it safe to use JSONP in IE8?
Update: JSONP is a common hack to do cross-domain requests. Modern browsers now have Cross Origin Resource Sharing, and IE8+ have XDomainRequest which is similar. See http://enable-cors.org/ for more info. JSONP is just a script include that allows you to use a callback. You should however be aware of Cross-site request forgery (CSRF).