javascript - Cross Domain Limitations With Ajax - JSON

Question

When requesting (ht|x)ml with ajax you can only send requests to the same domain. But if you request JSON you can send it to any domain. Why?

I'm told it's for security but why would a website do something malicious via ajax rather than just directly if that makes sense.

Answer 1

Check out this wikipedia article.

The reason why JSON is 'safe' is because you have to pass it through a callback. The remote site will run return JSON and your javascript library will not just run it blindly but try to pass it to a function you specify, like jsonpCallback( response ). Since you aren't running the remote code directly much more is under your control and all is mostly well in the world.