News for hackers. Stuff that matters.

A comment on How to gain code execution on hundreds of millions of people and popular apps. Parent comment

Re:How to gain code execution on hundreds of millions of peo... by bastawhiz on Sunday March 02, 2025 @05:48PM (#43236095)
Literally every website that uses JSONP will stop working if that happened. This would break the web in fundamental ways. If we're going to break the web in fundamental ways, resource integrity is hardly among the things that I'd be interested in changing.
[ Parent | on HN ]
Re:How to gain code execution on hundreds of millions of peo... by quacksilver on Monday March 03, 2025 @04:09AM (#43239863)
Why would people choose JSONP over CORS?

There are security risks with JSONP (a hack to bypass same-origin policy), and the successor (CORS) has been around since 2009, so phasing it out may be a good thing.

https://dev.to/benregenspan/the-state-of-jsonp-and-jsonp-vul...

[ Parent | on HN ]
Re:How to gain code execution on hundreds of millions of peo... by account42 on Tuesday March 04, 2025 @07:28AM (#43253680)
Good. JSONP requests to a domain you don't control are a security nightmare.
[ Parent | on HN ]