How is JSONP any safer than JSON in cross-domain requests?

Question

Why do browsers allow cross-origin JSONP requests and do not allow JSON requests? I know that JSON requests are not allowed to prevent XSS, but I don't see how JSONP is safer than JSON.

In fact, could JSONP be even more dangerous because it is technically a script, where JSON is just a text string?

Answer 1

Because cross-domain JSON is blocked, sensitive data can be transmitted using JSON, rather than JSONP. This prevents XSS. Additionally, a server should not send sensitive data using JSONP. Thus, sending data using JSON protects it from unauthorized observation. JSON is safer in this sense.

Answer 2

JSONP is not safer. It's a workaround/loophole/hack to get past the same origin policy.

CORS is the safer alternative to JSONP.