JSON is a powerful way to transmit or expose sets of data to jQuery or javascript. There are several api's such as twitter, flicker, and yahoo that allow this functionality. Unfortunately, it can be used for bad intentions. To curtail such experiences, a "defense system" for foreign requests was created. This defense places restrictions on requests that occur on cross-domain http requests via javascript for returning data in the JSON format.

For visualization:

To bypass this issue and reduce the opportunity for accidental exposure of vulnerabilites, you have to change the response type of requests for this scenario. In jQuery 1.2, JSONP support was introduced. Jsonp, or JSON with Padding, is a a way to wrap json responses in callback manner, and remove client side get requests allowing only posts.



example source

Using MVC, you can easily expose JSON responses with your Controller. A simple way is to return a JsonResult. To add JSONP functionality, however, you will have to create a custom class, or extend the existing JsonResult.

Changing something like this: {"Id" : 4, "Name" : "Matt Linder"}
to this:
callback({"Id" : 4, "Name" : "Matt Linder"});

I have implemented a default callback on the originating server, with the option to specify a custom consumer script for the callback, which seems to work well.

0 comments