JSON with Padding, or JSONP for short, is a technique that allows developers to get around browsers' same-origin policies by exploiting the nature of the <script> element.  The policy prohibits reading any responses made by websites with origins other than those currently in use. In addition, the policy allows for the submission of requests but not the reading of them.

It's a method of retrieving data that avoids the cross-domain problem.  To accomplish this, the script tag is needed.

What Is JSONP callback format?

After a browser sends an HTTP request to the source URL when it encounters the script element, the response from the server is JSON wrapped in a function call, which goes like this: 

• Insert the script tag in your HTML code.  The URL from which the data will be retrieved will be the source of this script tag.  A callback function can be specified for web services. 
• Insert the callback parameter at the end of the URL.  The browser parses the JSON answer—which is a string—and converts it to a JavaScript object.  The produced object is provided to the callback function, which is then called.

To receive data from the server, utilize the XMLHttpRequest (XHR) method. 

Once the data has been retrieved, the JSON.parse() method can turn the JSON expression into a JavaScript object. 

However, XHR has the same-origin security concern.  This implies that if you request a page from a domain, like ADomain.com, that page then performs an XMLHttpRequest to acquire data from BDomain.com, the browser will reject it.  That's because the request was sent to a domain other than the one that served the page.  The data will only be returned if the XMLHttpRequest is sent to ADomain.com, as XHR only operates if the request is made to the same domain.

What are JSONP callbacks?

JSONP is an informal protocol that allows you to make cross-domain calls by producing script tags on the current page and awaiting a response to a callback handler you provide.

The concept is that this code dynamically inserts a <script> tag into the page, and when this code loads, it causes the server-loaded JavaScript to be performed. The DOM and an <script> element are used to get around the XHR object's cross-site scripting constraints.

The server is expected to deliver JSON data, but with one caveat: The callback function name, which is provided as part of the URL, must be prepended.

You could use the callback query parameter with any eligible API route to receive your API response wrapped in a JSONP callback function.  The data will be returned with the callback function you specify wrapped around it.

Any valid JavaScript method name can be used as the callback value.  The complete JSON API response will be wrapped in the callback function requested.

Why do we need JSONP callbacks?

A large number of API providers now support JSONP queries.  This is because most internet browsers prevent cross-domain queries while utilizing basic Ajax.

If your website's domain is "a.com," for example, it will use JavaScript hosted on a.com.  Most web browsers will instantly mark an "AJAX call" made by the a.com JavaScript to complete the request on b.com as insecure and disable it.  It is the "same-origin policy," implemented by internet browsers to prevent dangerous scripts from transmitting data to a separate domain. Because you require the a.com JavaScript to visit b.com to perform your service, this appears to be a significant problem, and JSONP is here to help!

The "P" of JSONP—the "padding" or "prefix" all-around basic JSON—is the function call to parseResponse().  A server must respond with a response that comprises the JSONP function for JSONP to operate. 

With JSON-formatted results, JSONP doesn't work.  Instead, the client and server agree on the JSONP function activation delivered back and the payload that the function obtains.  The querying website is often given the option of naming the JSONP function by the server sending the JSON data, with the term JSONP or callback as the specified query-string argument.

JSONP was created in response to the same-origin policy (SOP), which specified that if an HTML page was provided from one domain, the web page could not make an "AJAX call" to a website on a separate domain once it was sent to the client. 

A callback is required for a JSONP call to work.  The file is loaded in a script tag, and if the code isn't in the format of a method call, the outcome will be an object that will be deleted, with the success callback function never being called.

How to use JSONP callbacks?

JSONP can be used in the following ways:

1. Include the script tag in your HTML code.  The URL from which the data will be retrieved will be the source of this script tag.  A callback function can be specified for web services. Include the callback parameter at the end of the URL.
2. To encounter the script element, the browser transmits the HTTP request to the source URL. 
3. The response from the server is JSON contained in a function call.
4. The browser parses the JSON answer, which is in the style of a string and converts it to a JavaScript object.  The produced object is provided to the callback function, which is then called.

What about enterprise usage of JSONP Callbacks?

JSONP has the advantage of not being constrained by the same-origin policy as the AJAX request put in place by the XMLHttpRequest object; it has good integration, can run in older browsers, and does not necessitate XMLHttpRequest or ActiveX support.  It also does not involve XMLHttpRequest or ActiveX support.  The outcome of the request can be sent by calling a callback once it has been completed.

JSONP has the drawback of only supporting GET requests and no other HTTP requests, such as POST; it only allows cross-domain HTTP requests.  In addition, it can't address the issue of how to call JavaScript from two separate domains on the same page.