JSONP is great for browser-facing APIs, because it can be loaded from anywhere bypassing the browsers same origin policy. However, those policies are there for

JSONP is great for browser-facing APIs, because it can be loaded from anywhere bypassing the browsers same origin policy. However, those policies are there for a reason. Only use JSONP for public data, never for any kind of secret or access-restricted data. Especially not if access is restricted bases on cookies or IP number. Session IDs that can used to access secret data are also secret.