CODEWITHSUNDEEP
c#jqueryasp.net-web-apijsonp
SOF User
SOF User

Reputation: 7840

Why my REST API clients need JSONP request?

I created REST base webAPI in MVC 4 and hosted on server when I call this from HTML on other domain and on my local pc I need to call it as JSONP request like put callback=? in url so it can be jsonp. My question is that why this is so? if its due to cross domain then how google and facbook and other companies host their api we also call it from our own domain but we dont keep callback=? in their url.

so why my API need callback=? in url if i call it from other domain or on my local pc with simple jquery html.

Upvotes: 0

Views: 176

Answers (2)

BuddhiP
BuddhiP

Reputation: 6461

Its because of the Same Origin Policy imposed by the browsers. See http://www.w3.org/Security/wiki/Same_Origin_Policy

http://en.wikipedia.org/wiki/Same_origin_policy

. Also note that CORS might be a better option than JSONP in the future

http://en.wikipedia.org/wiki/Cross-origin_resource_sharing

EDIT: ------------

If you have gone through above links you would see that JSONP allows users to work-around this Same Origin Policy security measure imposed by the browsers.

Trick is browsers allow tags to refer files in other domains than the origin.

Basically what happens is with JSONP, you send a callback function name to the server appended to the query string. Then the server will pad or prefix it's otherwise JSON request with a call to this function, hence the P in the name to denote response is padded or prefixed.

For example you can create a script tag like

then the target server, should send a response such that

mymethod({normal: 'json response'})

when this repsone is evaluated on the client side (as for any other javascript file) it will effectively call your method with the JSON response from that server.

However, this can only do GET requests.

If you want to make POST (PUT/DELETE) requests you need to use CORS in which server needs to set a specific header beforehand.

Access-Control-Allow-Origin: www.ext.site.com

Hope this helps.

Upvotes: 1

fyunli
fyunli

Reputation: 1

Because of the same-origin policy limitations. The same-origin policy prevents a script loaded from one domain from getting or manipulating properties of a document from another domain. That is, the domain of the requested URL must be the same as the domain of the current Web page. This basically means that the browser isolates content from different origins to guard them against manipulation.

Upvotes: 0

Related Questions