Contents
Should you use JSONP?
JSONP is still useful for older browser support, but given the security implications, unless you have no choice CORS is the better choice. JSONP is really a simple trick to overcome the XMLHttpRequest same domain policy. (As you know one cannot send AJAX (XMLHttpRequest) request to a different domain.)
Why is it important to use JSONP only with a Web service that you trust?
If the site from which you’re requesting data is compromised by malicious code, the content you receive from that site is a potential route to attack your site as well. For this reason, it’s important to use JSON-P only with a web service that you trust. around the same-origin policy to access third-party content.
Is dash allowed in JSON?
Hyphens no longer allowed but JSON API recommends them by default #206.
Are there any security issues with using JSONP?
There are security issues for both sides. The most serious one is for the site including JSONP. If you are including a from another domain (which you do not control), that domain can change up the script at any time. They can make the javascript do anything in the context of your webpage, that your own javascript could do.
Is it safe to use JSONP in IE8?
Update: JSONP is a common hack to do cross-domain requests. Modern browsers now have Cross Origin Resource Sharing, and IE8+ have XDomainRequest which is similar. See http://enable-cors.org/ for more info. JSONP is just a script include that allows you to use a callback. You should however be aware of Cross-site request forgery (CSRF).
How does Google Analytics use a JSONP request?
These days Google Analytics uses a JSONP request to load ga.js into user’s web pages via a callback function. According to the Wikipedia, JSONP can “inject any content into a website.”
Can a JSONP request trigger a CSRF token?
Standard advice is to ensure that only POST requests can trigger a side-effect, and to include a CSRF token in all POST requests; but JSONP involves sending a GET request to trigger a side-effect, which ain’t exactly the cleanest solution you’ve ever seen.