JavaScript: The Definitive Guide, 6th Edition

HTTP by <script>: JSONP

The introduction to this chapter mentioned that a <script> element can be used as an Ajax transport mechanism: simply set the src attribute of a <script> (and insert it into the document if it isn’t already there) and the browser will generate an HTTP request to download the URL you specify. <script> elements are useful Ajax transports for one primary reason: they are not subject to the same-origin policy, so you can use them to request data from servers other than your own. A secondary reason to use <script> elements is that they automatically decode (i.e., execute) response bodies that consist of JSON-encoded data.

Scripts and Security

In order to use a <script> element as an Ajax transport, you have to allow your web page to run whatever JavaScript code the remote server chooses to send you. This means that you must not use the technique described here with untrusted servers. And when you do use it with trusted servers, keep in mind that if an attacker can hack into that server, then the hacker can take over your web page, run any code she wants and display any content she wants, and that content will appear to come from your site.

With that said, note that it has become commonplace for websites to use trusted third-party scripts, especially to embed advertising or “widgets” into a page. Using a <script> as an Ajax transport to communicate with a trusted web service is no more dangerous than that.

The technique of using a <script> element as an Ajax transport ...