3 ms·
I agree... I mean look at JSONP, that's basically the inverse hack. After all: what's the point of enforcing same-origin-policy in AJAX but ignoring it for <s
by blablabla123 14y ago
I agree... I mean look at JSONP, that's basically the inverse hack. After all: what's the point of enforcing same-origin-policy in AJAX but ignoring it for <script>?
- mmahemoff 14y agoThe actual reason for this is web advertising took off like wildfire, using 3rd party scripts. It was too late to reverse by the time people got concerned about the security model. Content Security Policy makes all this much more robust in modern browsers.
- dspeyer 14y agoJSONP lets the server turn off the same-origin policy. If XRFing your data is dangerous, don't use JSONP. But often we don't care about XRF, and the person writing the server is well-placed to know.