Questions tagged [jsonp]

JSONP is a method of loading JSON data into web application through a script tag. It is often vulnerable to XSS. Since the introduction of CORS, it has gone out of use.

Filter by
Sorted by
Tagged with
0
votes
0answers
57 views

How to make a HTTPrequest in JSONP callback?

I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like: <script src="https://whitelisted.jsonp?callback=...
1
vote
1answer
1k views

How to prevent JSONP injection?

Recently, I came across many web applications that are using callback parameters to retrieve JSON formatted data. This makes web application vulnerable to JSONP injection attacks. What is the ...
1
vote
1answer
321 views

Is it safe to call an untrusted service with jquery.ajax and dataType 'jsonp'

From what I understand, the JSON-P technique generates a script tag into the DOM of an HTML page to get across the single-origin restrictions imposed on the XMLHttpRequest JavaScript API for AJAX ...
28
votes
3answers
17k views

Security risks with JSONP?

What are the security risks with JSONP? Is using JSONP in a new web application reasonable, from a security perspective, or is it better to use a different method for cross-origin web mashups? If ...