Cross Domain Limitations With Ajax - JSON

Question

When requesting (ht|x)ml with ajax you can only send requests to the same domain. But if you request JSON you can send it to any domain. Why?

I\'m told it\'s for sec

Answer 1

Injecting JSON directly in your page is not secure at all.

You offer to the loaded scripts full access to the resources in your page(data, cookies, logic).

If the injected code is malicious, it can run actions on your server, post back data to their server(POST is allowed cross domain, not the response but your data are sent anyway), etc...

We're building a web app that makes a heavy use of cross domain accesses.
To solve this problem, we came with a rather simple JSONP sandboxing solution.