Security of HTTP by <script> JSONP

Question

I use element <script> as an Ajax transport mechanism to set the src of a <script> and insert it into the document if isn't already there. The browser will generate an HTTP Request to download the URL. This is my code:

<script type="text/javascript" src="http://somedomain.com/service.js"/>

My questions are:

1. Is it possible?
2. What is the better way to do this?

I'd be grateful for any help you are able to provide.

Answer 1

1.It's Possible ?

Yes Ofcourse it's Possible, <script> element are useful Ajax Transports for One Primary Reason :

they are not subject to the same origin policy , so you can use them to request data from server other than your own.

2.What is the better way to do this ?

I think if you use <script> element as an Ajax Transport , You Have to Allow your Web Page to Run Whatever Javascript Code the remote server chooses to send you,This means that you must not use this technique described here with untrusted servers.

When You use trusted server, Keep in Mind if an Attacker can hack into that server, then the hacker can take over your web page run any code he wants and display any content he wants, and that content will appear to come your site.

Note that to use trusted third party script , especialy to embed advertising or "widgets" into a page, Using a <script> as an Ajax transport to communicate with trusted web service is no more dangerous than that.

the technique of using a <script> element as an Ajax transports has come to be knows as JSONP, it's work when the response body of the HTTP request is JSON-encode.