title: Why do browsers have Same-Origin policies when workarounds like JSONP and CORS exist?
body: <p>This question is kind of a duplicate of: <a href="https://stackoverflow.com/questions/1830050/why-same-origin-policy-for-xmlhttprequest">Why same origin policy for XMLHttpRequest</a></p>
  
  <p>However, this answer isn't satisfactory because it doesn't address the fact that there are workarounds (as stated in the question). The answer only addresses security concerns related directly to the XMLHttpRequest but these problems are still present with JSONP (and possibly CORS, not sure). So the question still remains - Why have a strict Same Origin policy when there are workarounds like JSONP that's arguably even worse (because it's executable rather than static content)?</p>
  
  <p>Here's an example:
  Company.com wants to make an AJAX call to some unprotected resource, like a simple public API for some data lookup. Company.com realizes that this may be insecure so they will carefully scrub the data to ensure there is no funny business. However, XMLHttpRequest does not allow this, so Company.com must use JSONP, but this would prevent the scrubbing of data and could result in an Attacker injecting arbitrary Javascript onto the page. How is this a better solution?</p>
  
  <p>Another example:
  Company.com has a vulnerability and an attacker is able to inject Javascript onto the page which is then viewable by some user (there are a million ways this can happen; it's probably the most common website attack). With a strict Same-Origin policy, the attacker can mess with the page all day long but he can't "call home" which is an important detail because it means all your data is safe. But JSONP (and image tags) break this by allowing the attacker to scrape all your personal data from the page and send it wherever. This is still a reality even with CORS because I can tell my rogue server to allow inbound XS requests from any domain.</p>
  
  <p>In other words, in what scenario does a locked-down XMLHttpRequest actually provide a greater degree of security?</p>