JSONP

JSONP exploits the fact that <script> tags are not subject to the same-origin policy. The client dynamically creates a script element with a URL like https://api.example.com/data?callback=myFunc. The server wraps the JSON response in a function call: myFunc({"key":"value"}). When the script loads, the browser executes it, invoking the callback with the data.¹

The technique was popularized in 2005 by Bob Ippolito, who described it as a way to fetch cross-domain data without server-side proxies. It became widely used before CORS was standardized, especially for public APIs like Flickr and Twitter.

JSONP introduces significant security risks. Because it relies on script injection, any compromised or malicious server can execute arbitrary JavaScript in the client's context, leading to data theft or session hijacking. The callback parameter is often attacker-controlled, enabling reflected XSS if not properly sanitized.

Additionally, JSONP only supports GET requests, which can leak sensitive data through browser history, proxy logs, and referrer headers. CSRF attacks can also be mounted by tricking a user's browser into making a JSONP request to an authenticated endpoint.²

With the adoption of Cross-Origin Resource Sharing (CORS) and the Fetch API, JSONP has become largely obsolete. CORS provides a safer, more flexible mechanism for cross-origin requests, supporting all HTTP methods and allowing server-controlled access policies. Modern browsers also enforce stricter content security policies that often block JSONP.³

Nevertheless, JSONP remains in use in legacy systems, some older APIs, and environments where CORS is not available, such as certain embedded devices or intranet applications. Understanding JSONP is also valuable for security researchers analyzing historical vulnerabilities.⁴

JSONP has several niche details. The 'padding' can be any JavaScript expression, not just a function call, allowing for creative but risky responses. Some services used JSONP for JSON-P (JSON with Padding) vs. JSON-P (JSON Patch) confusion, though unrelated. The technique was also used for cross-domain communication in early mashups and for loading third-party widgets.⁵

Security researchers have demonstrated JSONP hijacking attacks, where a malicious page reads sensitive data from a vulnerable API. Some APIs implemented 'callback' parameter validation to mitigate this, but the fundamental risk remains. JSONP also influenced the design of early CORS proposals, as developers sought a safer alternative.

Same-origin policy

A browser security mechanism that restricts scripts from accessing resources from a different origin.

CORS

Cross-Origin Resource Sharing, a standardized HTTP header-based mechanism for allowing cross-origin requests.

Callback function

A function passed as a parameter that is invoked after a certain event, in JSONP it receives the data.