AJAX vs JSONP

[Rod Widdowson]

When I saw the subject I thought that this post was about Discovery, and I know that some federations have looked at using JSONP for
discovery.  The argument goes that the discovery process was going to redirect to the site anywhere and "What could possibly go
wrong (TM) that wasn't already a potential problem".

I understand the argument.  However I would argue very forcefully before the UK Federation started to deploy such software, and I am
going to do my damndedest to make sure that the I never check code into Shibboleth that explicitly subverts the browsers' security
model.

So I'm hardly an expert on deploying JSONP (!).  However I'd propose that you ask yourself a couple questions:

- Are you happy with deploying XSS software and having it associated with your organization?
- Are the people who will deploy this stuff aware of the risks you are involving them in, such that they can put in expedient
solutions if things go pear shaped?

Because I'm self employed I'd also be looking for legal protection against my actions turning out to have bad consequences.  

Remember, you can always take the blade guards of a circular saw, but people tend to be less tolerant of accidents that then happen
(and I speak as one with 9.5 fingers).

> -----Original Message-----
> From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Tom Scavo
> Sent: 23 October 2011 22:23
> To: Shibboleth Developers
> Subject: AJAX vs JSONP
> 
> We have a process that converts XML metadata into JSON format and a
> couple of client-side web applications (HTML, CSS, and JavaScript)
> that fetch static JSON metadata via AJAX. The browser's same origin
> policy is making the deployment, uh, interesting, so the thought is to
> abandon AJAX in favor of JSONP so that the JSON files can be served
> from a central server. I realize there are concerns with JSONP
> generally, but in this case, are there security issues or other
> problems that we should be aware of?
> 
> Ultimately we want to distribute code that fetches static metadata via
> JSONP and exposes it to web applications via a JavaScript API. The
> initial use case is federated error handling but most any
> browser-based UI could leverage metadata in this way, I suppose. Is
> this a viable approach to building browser-based interfaces? Would you
> use it?
> 
> Thanks,
> Tom
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net