How is this JSONP without a callback working?
I'm using a client-side SDK, which creates a script under the hood and attaches it to the <head>, and looks like the following:
<script src="http://foo.com?foo=bar"></script>
Notice that there's no callback parameter.
The response sends back the following (with header Content-Type: application/javascript):
document.cookie="something=thing"
And it sets the cookie in the browser (I can see when I look at the cookies in the dev tools).
The strange this is, in the URL of the script, there's no callback parameter, as you would normally expect in a JSONP request.
I tried to replicate this behavior by adding a similar script to a local web page and am hitting a local server that returns the same response, but it doesn't set a cookie, unlike the SDK. The SDK itself is pretty simple and I don't see any other magic happening.
Has anyone seen anything like this before? How does it work?
Edit: here is the internal SDK method and sample response
_jsonp: function(o, e)
var t = document.createElement("script");
t.type = "text/javascript", t.src = e, t.async = !0, document.getElementsByTagName("head")[0].appendChild(t), o.log("SENT JSONP request: " + e)
,
Sample response:
Response headers
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 158
Content-Type: application/javascript
Response body
document.cookie=<redacted>
javascript jsonp
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
|
show 1 more comment
I'm using a client-side SDK, which creates a script under the hood and attaches it to the <head>, and looks like the following:
<script src="http://foo.com?foo=bar"></script>
Notice that there's no callback parameter.
The response sends back the following (with header Content-Type: application/javascript):
document.cookie="something=thing"
And it sets the cookie in the browser (I can see when I look at the cookies in the dev tools).
The strange this is, in the URL of the script, there's no callback parameter, as you would normally expect in a JSONP request.
I tried to replicate this behavior by adding a similar script to a local web page and am hitting a local server that returns the same response, but it doesn't set a cookie, unlike the SDK. The SDK itself is pretty simple and I don't see any other magic happening.
Has anyone seen anything like this before? How does it work?
Edit: here is the internal SDK method and sample response
_jsonp: function(o, e)
var t = document.createElement("script");
t.type = "text/javascript", t.src = e, t.async = !0, document.getElementsByTagName("head")[0].appendChild(t), o.log("SENT JSONP request: " + e)
,
Sample response:
Response headers
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 158
Content-Type: application/javascript
Response body
document.cookie=<redacted>
javascript jsonp
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
That's not really a jsonp request. It's really just a javascript file.
– Kevin B
Nov 13 '18 at 23:05
@KevinB yeah, I guess I'm just wondering how that response is getting executed. Additionally, they're calling it a_jsonpmethod under the hood, so I assumed their intent was to make a jsonp request.
– Josh Beam
Nov 13 '18 at 23:07
1
It isn't a jsonp request because the request isn't returning JSONP. it's returning javascript. a jsonp response is also javascript, but not all javascript is jsonp.
– Kevin B
Nov 13 '18 at 23:07
@KevinB Okay, let's pretend their method namejsonpis simply a misnomer. We still haven't answered the question about how the response is getting executed. FWIW, here's the entire minified SDK, which can sorta be read if you have a prettifier in chrome or whatever: assets.jetlore.com/js/jltracking.js
– Josh Beam
Nov 13 '18 at 23:09
All this code is doing is setting a cookie. when you include it, it sets a cookie. that's... all it is.document.cookie=<redacted>isn't an object, it's just plain old javascript. It very well could have simply beenalert('Hello World!')and an alert woulda popped up.
– Kevin B
Nov 13 '18 at 23:09
|
show 1 more comment
I'm using a client-side SDK, which creates a script under the hood and attaches it to the <head>, and looks like the following:
<script src="http://foo.com?foo=bar"></script>
Notice that there's no callback parameter.
The response sends back the following (with header Content-Type: application/javascript):
document.cookie="something=thing"
And it sets the cookie in the browser (I can see when I look at the cookies in the dev tools).
The strange this is, in the URL of the script, there's no callback parameter, as you would normally expect in a JSONP request.
I tried to replicate this behavior by adding a similar script to a local web page and am hitting a local server that returns the same response, but it doesn't set a cookie, unlike the SDK. The SDK itself is pretty simple and I don't see any other magic happening.
Has anyone seen anything like this before? How does it work?
Edit: here is the internal SDK method and sample response
_jsonp: function(o, e)
var t = document.createElement("script");
t.type = "text/javascript", t.src = e, t.async = !0, document.getElementsByTagName("head")[0].appendChild(t), o.log("SENT JSONP request: " + e)
,
Sample response:
Response headers
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 158
Content-Type: application/javascript
Response body
document.cookie=<redacted>
javascript jsonp
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
I'm using a client-side SDK, which creates a script under the hood and attaches it to the <head>, and looks like the following:
<script src="http://foo.com?foo=bar"></script>
Notice that there's no callback parameter.
The response sends back the following (with header Content-Type: application/javascript):
document.cookie="something=thing"
And it sets the cookie in the browser (I can see when I look at the cookies in the dev tools).
The strange this is, in the URL of the script, there's no callback parameter, as you would normally expect in a JSONP request.
I tried to replicate this behavior by adding a similar script to a local web page and am hitting a local server that returns the same response, but it doesn't set a cookie, unlike the SDK. The SDK itself is pretty simple and I don't see any other magic happening.
Has anyone seen anything like this before? How does it work?
Edit: here is the internal SDK method and sample response
_jsonp: function(o, e)
var t = document.createElement("script");
t.type = "text/javascript", t.src = e, t.async = !0, document.getElementsByTagName("head")[0].appendChild(t), o.log("SENT JSONP request: " + e)
,
Sample response:
Response headers
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 158
Content-Type: application/javascript
Response body
document.cookie=<redacted>
javascript jsonp
javascript jsonp
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
edited Nov 13 '18 at 23:06
Josh Beam
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
asked Nov 13 '18 at 23:03
Josh BeamJosh Beam
13.9k22356
13.9k22356
That's not really a jsonp request. It's really just a javascript file.
– Kevin B
Nov 13 '18 at 23:05
@KevinB yeah, I guess I'm just wondering how that response is getting executed. Additionally, they're calling it a_jsonpmethod under the hood, so I assumed their intent was to make a jsonp request.
– Josh Beam
Nov 13 '18 at 23:07
1
It isn't a jsonp request because the request isn't returning JSONP. it's returning javascript. a jsonp response is also javascript, but not all javascript is jsonp.
– Kevin B
Nov 13 '18 at 23:07
@KevinB Okay, let's pretend their method namejsonpis simply a misnomer. We still haven't answered the question about how the response is getting executed. FWIW, here's the entire minified SDK, which can sorta be read if you have a prettifier in chrome or whatever: assets.jetlore.com/js/jltracking.js
– Josh Beam
Nov 13 '18 at 23:09
All this code is doing is setting a cookie. when you include it, it sets a cookie. that's... all it is.document.cookie=<redacted>isn't an object, it's just plain old javascript. It very well could have simply beenalert('Hello World!')and an alert woulda popped up.
– Kevin B
Nov 13 '18 at 23:09
|
show 1 more comment
That's not really a jsonp request. It's really just a javascript file.
– Kevin B
Nov 13 '18 at 23:05
@KevinB yeah, I guess I'm just wondering how that response is getting executed. Additionally, they're calling it a_jsonpmethod under the hood, so I assumed their intent was to make a jsonp request.
– Josh Beam
Nov 13 '18 at 23:07
1
It isn't a jsonp request because the request isn't returning JSONP. it's returning javascript. a jsonp response is also javascript, but not all javascript is jsonp.
– Kevin B
Nov 13 '18 at 23:07
@KevinB Okay, let's pretend their method namejsonpis simply a misnomer. We still haven't answered the question about how the response is getting executed. FWIW, here's the entire minified SDK, which can sorta be read if you have a prettifier in chrome or whatever: assets.jetlore.com/js/jltracking.js
– Josh Beam
Nov 13 '18 at 23:09
All this code is doing is setting a cookie. when you include it, it sets a cookie. that's... all it is.document.cookie=<redacted>isn't an object, it's just plain old javascript. It very well could have simply beenalert('Hello World!')and an alert woulda popped up.
– Kevin B
Nov 13 '18 at 23:09
That's not really a jsonp request. It's really just a javascript file.
– Kevin B
Nov 13 '18 at 23:05
That's not really a jsonp request. It's really just a javascript file.
– Kevin B
Nov 13 '18 at 23:05
@KevinB yeah, I guess I'm just wondering how that response is getting executed. Additionally, they're calling it a
_jsonp method under the hood, so I assumed their intent was to make a jsonp request.– Josh Beam
Nov 13 '18 at 23:07
@KevinB yeah, I guess I'm just wondering how that response is getting executed. Additionally, they're calling it a
_jsonp method under the hood, so I assumed their intent was to make a jsonp request.– Josh Beam
Nov 13 '18 at 23:07
1
1
It isn't a jsonp request because the request isn't returning JSONP. it's returning javascript. a jsonp response is also javascript, but not all javascript is jsonp.
– Kevin B
Nov 13 '18 at 23:07
It isn't a jsonp request because the request isn't returning JSONP. it's returning javascript. a jsonp response is also javascript, but not all javascript is jsonp.
– Kevin B
Nov 13 '18 at 23:07
@KevinB Okay, let's pretend their method name
jsonp is simply a misnomer. We still haven't answered the question about how the response is getting executed. FWIW, here's the entire minified SDK, which can sorta be read if you have a prettifier in chrome or whatever: assets.jetlore.com/js/jltracking.js– Josh Beam
Nov 13 '18 at 23:09
@KevinB Okay, let's pretend their method name
jsonp is simply a misnomer. We still haven't answered the question about how the response is getting executed. FWIW, here's the entire minified SDK, which can sorta be read if you have a prettifier in chrome or whatever: assets.jetlore.com/js/jltracking.js– Josh Beam
Nov 13 '18 at 23:09
All this code is doing is setting a cookie. when you include it, it sets a cookie. that's... all it is.
document.cookie=<redacted> isn't an object, it's just plain old javascript. It very well could have simply been alert('Hello World!') and an alert woulda popped up.– Kevin B
Nov 13 '18 at 23:09
All this code is doing is setting a cookie. when you include it, it sets a cookie. that's... all it is.
document.cookie=<redacted> isn't an object, it's just plain old javascript. It very well could have simply been alert('Hello World!') and an alert woulda popped up.– Kevin B
Nov 13 '18 at 23:09
|
show 1 more comment
1 Answer
1
active
oldest
votes
Despite the method name in the API source code, it isn't JSONP.
JSONP is a JavaScript program which conforms to the specific format of: Contains only a function call, with one argument, which would be JSON if it was taken out of the JavaScript program and put in a JSON file.
JSONP works by injecting a <script> element which loads and executes the JavaScript program.
What you have here is a JavaScript program that doesn't conform to the JSONP format.
It is still a JavaScript program.
Loading with a <script> still works.
Thanks. FWIW, I didn't realizedocument.cookie="something=thing"is valid JavaScript, but lo and behold when I run it in the browser console, it works. Will accept the answer when the time limit expires
– Josh Beam
Nov 13 '18 at 23:14
1
The block around the assignment expression is entirely pointless.
– Quentin
Nov 13 '18 at 23:15
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53290814%2fhow-is-this-jsonp-without-a-callback-working%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Despite the method name in the API source code, it isn't JSONP.
JSONP is a JavaScript program which conforms to the specific format of: Contains only a function call, with one argument, which would be JSON if it was taken out of the JavaScript program and put in a JSON file.
JSONP works by injecting a <script> element which loads and executes the JavaScript program.
What you have here is a JavaScript program that doesn't conform to the JSONP format.
It is still a JavaScript program.
Loading with a <script> still works.
Thanks. FWIW, I didn't realizedocument.cookie="something=thing"is valid JavaScript, but lo and behold when I run it in the browser console, it works. Will accept the answer when the time limit expires
– Josh Beam
Nov 13 '18 at 23:14
1
The block around the assignment expression is entirely pointless.
– Quentin
Nov 13 '18 at 23:15
add a comment |
Despite the method name in the API source code, it isn't JSONP.
JSONP is a JavaScript program which conforms to the specific format of: Contains only a function call, with one argument, which would be JSON if it was taken out of the JavaScript program and put in a JSON file.
JSONP works by injecting a <script> element which loads and executes the JavaScript program.
What you have here is a JavaScript program that doesn't conform to the JSONP format.
It is still a JavaScript program.
Loading with a <script> still works.
Thanks. FWIW, I didn't realizedocument.cookie="something=thing"is valid JavaScript, but lo and behold when I run it in the browser console, it works. Will accept the answer when the time limit expires
– Josh Beam
Nov 13 '18 at 23:14
1
The block around the assignment expression is entirely pointless.
– Quentin
Nov 13 '18 at 23:15
add a comment |
Despite the method name in the API source code, it isn't JSONP.
JSONP is a JavaScript program which conforms to the specific format of: Contains only a function call, with one argument, which would be JSON if it was taken out of the JavaScript program and put in a JSON file.
JSONP works by injecting a <script> element which loads and executes the JavaScript program.
What you have here is a JavaScript program that doesn't conform to the JSONP format.
It is still a JavaScript program.
Loading with a <script> still works.
Despite the method name in the API source code, it isn't JSONP.
JSONP is a JavaScript program which conforms to the specific format of: Contains only a function call, with one argument, which would be JSON if it was taken out of the JavaScript program and put in a JSON file.
JSONP works by injecting a <script> element which loads and executes the JavaScript program.
What you have here is a JavaScript program that doesn't conform to the JSONP format.
It is still a JavaScript program.
Loading with a <script> still works.
answered Nov 13 '18 at 23:11
community wiki
Quentin
Thanks. FWIW, I didn't realizedocument.cookie="something=thing"is valid JavaScript, but lo and behold when I run it in the browser console, it works. Will accept the answer when the time limit expires
– Josh Beam
Nov 13 '18 at 23:14
1
The block around the assignment expression is entirely pointless.
– Quentin
Nov 13 '18 at 23:15
add a comment |
Thanks. FWIW, I didn't realizedocument.cookie="something=thing"is valid JavaScript, but lo and behold when I run it in the browser console, it works. Will accept the answer when the time limit expires
– Josh Beam
Nov 13 '18 at 23:14
1
The block around the assignment expression is entirely pointless.
– Quentin
Nov 13 '18 at 23:15
Thanks. FWIW, I didn't realize
document.cookie="something=thing" is valid JavaScript, but lo and behold when I run it in the browser console, it works. Will accept the answer when the time limit expires– Josh Beam
Nov 13 '18 at 23:14
Thanks. FWIW, I didn't realize
document.cookie="something=thing" is valid JavaScript, but lo and behold when I run it in the browser console, it works. Will accept the answer when the time limit expires– Josh Beam
Nov 13 '18 at 23:14
1
1
The block around the assignment expression is entirely pointless.
– Quentin
Nov 13 '18 at 23:15
The block around the assignment expression is entirely pointless.
– Quentin
Nov 13 '18 at 23:15
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53290814%2fhow-is-this-jsonp-without-a-callback-working%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
That's not really a jsonp request. It's really just a javascript file.
– Kevin B
Nov 13 '18 at 23:05
@KevinB yeah, I guess I'm just wondering how that response is getting executed. Additionally, they're calling it a
_jsonpmethod under the hood, so I assumed their intent was to make a jsonp request.– Josh Beam
Nov 13 '18 at 23:07
1
It isn't a jsonp request because the request isn't returning JSONP. it's returning javascript. a jsonp response is also javascript, but not all javascript is jsonp.
– Kevin B
Nov 13 '18 at 23:07
@KevinB Okay, let's pretend their method name
jsonpis simply a misnomer. We still haven't answered the question about how the response is getting executed. FWIW, here's the entire minified SDK, which can sorta be read if you have a prettifier in chrome or whatever: assets.jetlore.com/js/jltracking.js– Josh Beam
Nov 13 '18 at 23:09
All this code is doing is setting a cookie. when you include it, it sets a cookie. that's... all it is.
document.cookie=<redacted>isn't an object, it's just plain old javascript. It very well could have simply beenalert('Hello World!')and an alert woulda popped up.– Kevin B
Nov 13 '18 at 23:09