<p>If you're building an <code>AJA~Xy</code> app, are there any downsides to using <code>JSONP</code> requests/responses even if you're not planning on any <code>cross-domain</code> requests? </p>

<p>The only thing I can think of is that there are a couple extra bytes for the callback wrapper... </p>

<p><strong>Edit:</strong></p>

<p>I found <a href="http://remysharp.com/2007/10/08/what-is-jsonp/" rel="nofollow noreferrer">this</a> which also suggests <code>security and error handling</code> as potential problems... </p>

<blockquote>
  <p>There's no error handling. The <code>script injection</code> either works, or it doesn't.
  If there's an error from the <code>injection</code>, it'll hit the page, and short of a window wide error handler (bad, bad, very bad), you need to be sure the return value is valid on the <code>server side</code>.</p>
</blockquote>

<p>I don't think <code>error handling</code> is much of a problem... most of us would use a library to generate the <code>JSON</code>... the well-formedness of my response isn't a concern for this question.</p>

<p><strong>and security:</strong></p>

<blockquote>
  <p>There are documents out on the web that can help, but as a cursory check, I would check the referrer in the <code>server side</code> script.</p>
</blockquote>

<p>it seems like this is a potential problem with any type of response... certainly, there's nothing unique to <code>JSONP</code> in the security arena...?</p>

[{'answer_id': 19229, 'author': 'Nick Berardi', 'author_id': 17, 'author_profile': 'https://Stackoverflow.com/users/17', 'pm_score': 2, 'selected': False, 'text': "<p>I would say the biggest limitation might be the extra overhead for have the browser render a script tag to call the server.  Plus is JSONP really considered AJAX since it doesn't actually use the XMLHttpRequest object?</p>\n"}, {'answer_id': 23208, 'author': 'Shog9', 'author_id': 811, 'author_profile': 'https://Stackoverflow.com/users/811', 'pm_score': 4, 'selected': True, 'text': '<p>Downside? It\'s fairly limited - you trigger a "GET" request and get back some script that\'s executed. You don\'t get error handling if your server throws an error, so you need to wrap all errors in JSON as well. You can\'t really cancel or retry the request. You\'re at the mercy of the various browser author opinions of "correct" behavior for dynamically-generated <code>&lt;script&gt;</code> tags. Debugging is somewhat more difficult. </p>\n\n<p>That said, i\'ve used it on occasion, and haven\'t suffered. YMMV.</p>\n'}, {'answer_id': 623038, 'author': 'Julian Aubourg', 'author_id': 75192, 'author_profile': 'https://Stackoverflow.com/users/75192', 'pm_score': 3, 'selected': False, 'text': '<p>Retrieving errors when a jsonp call fails is possible.</p>\n\n<p><a href="http://code.google.com/p/jquery-jsonp/" rel="nofollow noreferrer">http://code.google.com/p/jquery-jsonp/</a></p>\n\n<p>Hope it helps.</p>\n'}, {'answer_id': 1455844, 'author': 'danb', 'author_id': 2031, 'author_profile': 'https://Stackoverflow.com/users/2031', 'pm_score': 0, 'selected': False, 'text': '<p>Here is another bit you may want to consider with JSONP.. possible memory leaks.. </p>\n\n<p><a href="http://neil.fraser.name/news/2009/07/27/" rel="nofollow noreferrer">http://neil.fraser.name/news/2009/07/27/</a></p>\n'}]
['https://Stackoverflow.com/questions/19173', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/2031/']