Is anyone using JSONP in Web mapping applications to get around the browser same origin policy?

Question

Javascript based Web mapping apps that use ajax requests to get data from a server are limited by the Same Origin Policy to only request the data from a server in the same domain (subdomain and port).

One method commonly used to get around this is to have a script that acts as a proxy located within the same domain. The proxy sends the request to the server outside of the domain and then forwards the results back to the requesting browser.

I have heard of some non-spatial Web apps using JSONP "Javascript Object Notation with Padding" to get around the same origin policy. I haven't seen it in use in any Web mapping apps.

Can anyone identify an example? What are the pros and cons?

Answer 1

There are plenty of APIs out there support JSON-P and use spatial data. Here's an example of a little youtube spatial search app I did: http://swingley.appspot.com/maps/yt

The youtube API returns JSON-P. GeoNames also has several web services that return JSON-P.

The pros of this are that you can do everything on the client- there's no server side processing necessary and no proxy required. The cons would be that you're at the mercy of the API/data provider and there might be some security concerns.

Answer 2

Take a look at CORS from w3C. Available now in most widely used browsers and removes the need for jsonp and similar work around communication protocols within a w3c standard....

http://www.html5rocks.com/en/tutorials/cors/

very handy solution to XSS issues.

Enjoy. Mike

Answer 3

I use JSON-P in many applications, but generally, I do so by working at the application level (rather than having support for JSON-P in the library). Reading data via JSON-P was widely used by MetaCarta in their projects for a while -- the goal being to make it possible to deploy anywhere without needing to set up a proxy.

At the moment, the technology is easy enough to integrate at the application level; in the future, I expect more people to want library support for it, but in my experience, there isn't much support for this kind of functionality.

Answer 4

Check out bFlood's Arc2Earth Google Mapplet demo and the supporting API for accessing the parcel data, which supports JSONP requests.

Answer 5

Consider my answer a con. In some situations it may be easier to modify the environment rather than somebody else's service or even your own to use JSONP. I would go for the proxy solution with sub domains. It is more regurgitation than processing so it only costs you I/O and the only change should be the DNS names. In addition when you use sub domains you can get more throughput to the clients browser which if I recall correctly is capped at 2 active requests per host. This way if the service the proxy wraps has 1 DNS name but you need to make 4 requests, by using 2 sub domains to proxy it you not only get the data to the client from a trusted party, the reason for the limitation but also theoretically double throughput. To see it in action just watch the requests for Google maps.

Answer 6

GeoREST supports JSONP responses in any case where you're returning JSON by specifying a function name to use in the callback parameter.

(disclosure: I'm on the GeoREST PSC)