Essentials of Javascript - Cultural View

JSON 104
parseResponse({"Name": "Cheeso", "Rank": 7})
...which can cause a change of state within the browser's execution context, because it invokes a method.
The Padding
While the padding (prefix) is typically the name of a callback function that is defined within the execution context of
the browser, it may also be a variable assignment, an if statement, or any other Javascript statement prefix.
Script Tag Injection
But to make a JSONP call, you need a script tag. Therefore, for each new JSONP request, the browser must add a
new tag -- in other words, inject the tag -- into the HTML DOM, with the desired value for the src attribute.
This element is then evaluated, the src URL is retrieved, and the response JSON is evaluated.
In that way, the use of JSONP can be said to allow browser pages to work around the same origin policy via script
tag injection.
Basic Security concerns
Because JSONP makes use of script tags, calls are essentially open to the world. For that reason, JSONP may be
inappropriate for carrying sensitive data. [24]
Including script tags from remote sites allows the remote sites to inject any content into a website. If the remote sites
have vulnerabilities that allow JavaScript injection, the original site can also be affected.
Cross-site request forgery
Naïve deployments of JSONP are subject to cross-site request forgery attacks (CSRF or XSRF). [25] Because the
HTML tag does not respect the same origin policy in web browser implementations, a malicious page can
request and obtain JSON data belonging to another site. This will allow the JSON-encoded data to be evaluated in
the context of the malicious page, possibly divulging passwords or other sensitive data if the user is currently logged
into the other site.
This is only a problem if the JSON-encoded data contains sensitive information that should not be disclosed to a
third party, and the server depends on the browser's Same Origin Policy to block the delivery of the data in the case
of an improper request. There is no problem if the server determines the propriety of the request itself, only putting
the data on the wire if the request is proper. Cookies are not by themselves adequate for determining if a request was
authorized. Exclusive use of cookies is subject to cross-site request forgery.
History
The original proposal for JSONP appears to have been made by Bob Ippolito in 2005 [26] and is now used by many
Web 2.0 applications such as Dojo Toolkit Applications, Google Web Toolkit Applications [27] and Web Services.
Further extensions of this protocol have been proposed by considering additional input arguments as, for example, is
the case of JSONPP [28] supported by S3DB web services.
Object references
The JSON standard does not support object references, but the Dojo Toolkit illustrates how conventions can be
adopted to support such references using standard JSON. Specifically, the dojox.json.ref [29] module provides
support for several forms of referencing including circular, multiple, inter-message, and lazy referencing. [30]