4 ms·
Executing "untrusted" 3rd party JavaScript in the context of the calling page is the whole point of JSONP. Cool hack, but I don't see where this is useful.
by qeorge 17y ago
Executing "untrusted" 3rd party JavaScript in the context of the calling page is the whole point of JSONP.
Cool hack, but I don't see where this is useful.
- petewarden 17y agoI want data from a 3rd party API _not_ code. If I call Google's search API I want to get back an array of search results, but they can run arbitrary code on my page if they feel like it. I want them to call back my supplied function with the data. That I have to allow them to execute arbitrary code they supply to do that is a flaw. Having said that, using CSS as the delivery mechanism seems pretty exotic, so I'm not advocating this as the solution, but there is a problem out there.