title: allow cross-domain requests to ASP.NET ScriptService
body: <p>I've got a ASP.NET Webservice up and running using the [ScriptService] Attribute. From what I've read from this article: </p>
  
  <p><a href="http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-these-attacks.aspx" rel="nofollow">http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-these-attacks.aspx</a></p>
  
  <p>ASP.NET by defaults does not allow JSONP requests (injected into the DOM via  to deny cross-domain-requests. Its does so by taking 2 measures:</p>
  
  <p>1) only accept POST requests (script injection via  always does GET)
  2) deny connections sending a HTTP header Content-type other than "Content-type: application/json" (which browsers will not send).</p>
  
  <p>I am familiar with the cross-domain issues and I know what JSONP is and I fully understand, why ASP.NET is by default restricted in that way.</p>
  
  <p>But now, I have my webservice which is a public one, and should be open to everybody. So I explicitly need to enable cross-domain requests via Javascript to my Webservice, so that external websites can retrieve data via my webservice from jquery and alike.</p>
  
  <p>I've already covered step (1) to allow requests via GET by modifiying the ScriptMethod Attribute this way: [ScriptMethod(UseHttpGet=true)]. I've checked with jQuery, GET requests now work (on same-domain). But how to get to fix point (2)?</p>
  
  <p>I know about the Allow-Origin-* headers some browsers support, but afaik its not standard yet, and I don't want to force my users / customers to modify their HTTP headers for using my webservice.</p>
  
  <p>To sum it up: I need the good practice to enable Cross-domain requests for ScriptingService for public Webservices via JSON. I mean there MUST be a way to have a Webservice public, that is what most webservices are about?</p>