DiscoFeed and jsonp

[Janusz Ulanowski]

On 28/01/16 10:12, Rod Widdowson wrote:
> FYI (and off the topic which is about the server)
>
> The EDS does not use JSONP, it doesn't even use JQuery (which can use
> JSONP).  It uses raw XMLHeader.
>
> I have a deep rooted distrust of any technology which "overcome[s] the
> cross-domain restrictions imposed by browsers".  To my mind it’s a very
> short step from that to XSS.  Indeed I prefer to think of it as XSS.  I
> don't even want to try the handle of that door let alone open it.  The web
> is quite insecure enough without me inadvertently introducing more
> insecurity (in the guise of a security product) and I do not have the skills
> (and the team does not have the time) to bottom out the precise security
> implications for the EDS.
>
> YMMV of course.
>
> Rod
>
>
Thanks Rod,
That's fair enough. I was just curious about that feature.
-- 
Janusz