y server won&#39;t serve malicious code and it requires polluting the global JavaScript scope. Nonetheless, it is sometimes the only available way to retrieve data from a service (for example, if the service doesn&#39;t support <a href="https://en.wikipedia.org/wiki/Cross-origin_resource_sharing">CORS</a>).</p>
<hr>
<h3 id="typical-usage"><a href="#typical-usage">Typical usage</a></h3>
<p>Some services follow the de-facto convention of responding with JSON-P if a <code>callback</code> querystring key is pro