3 ms·
He does say that "Unlike JSONP, untrusted third-party JavaScript cannot execute in the context of the calling page." I'm not sure why, and I would assume that'
by lux 18y ago
He does say that "Unlike JSONP, untrusted third-party JavaScript cannot execute in the context of the calling page." I'm not sure why, and I would assume that's as long as you never call eval(), but it would be good to know why he thinks this is a more secure idea.
Also didn't see a list of browsers it supports. That would be helpful too. If it's widely supported, this could be a good way to get data feeds from 3rd party sites and not have to do any server-side processing on your end.
- lux 18y agoLooking at his source, he does an eval() in the first line of his response handler for the flickr example. I imagine you could do a JSON.parse() instead of eval() -- preferably! -- but if he says it's secure, what about that line?
- tlrobinson 18y agoThey key here though is that evaluating untrusted code from a 3rd party site is not a requirement of the transport. That eval is in the client code and it could just as easily be a safer alternative (either checking that it's sanitary with a regex or using a library's JSON decode function) With JSONP you necessarily have to execute untrusted code, since JSONP works by loading JavaScript in a <script> tag.
- lux 18y agoI see. Thanks for that info, I wasn't familiar with JSONP's technique. In that case, this does sound like a pretty cool library!