{"id":477749,"date":"2023-08-09T09:19:35","date_gmt":"2023-08-09T09:19:35","guid":{"rendered":""},"modified":"2023-09-05T11:15:18","modified_gmt":"2023-09-05T11:15:18","slug":"jsonp-injection","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/jsonp-injection\/","title":{"rendered":"JSONP\u6ce8\u5165"},"content":{"rendered":"<p>JSONP\uff08\u5e26\u586b\u5145\u7684 JSON\uff09\u6ce8\u5165\u662f\u4e00\u79cd Web \u5b89\u5168\u6f0f\u6d1e\uff0c\u5f53\u653b\u51fb\u8005\u64cd\u7eb5\u7f51\u7ad9\u7684 JSONP \u7aef\u70b9\u6765\u6267\u884c\u4efb\u610f\u4ee3\u7801\u6216\u7a83\u53d6\u7528\u6237\u7684\u654f\u611f\u6570\u636e\u65f6\uff0c\u5c31\u4f1a\u53d1\u751f\u8be5\u6f0f\u6d1e\u3002 JSONP \u6ce8\u5165\u5229\u7528 JSONP \u8bf7\u6c42\u7684\u5bbd\u677e\u6027\u8d28\u6765\u7ed5\u8fc7\u540c\u6e90\u7b56\u7565\uff0c\u8be5\u7b56\u7565\u9650\u5236\u7f51\u9875\u5411\u9664\u81ea\u5df1\u4ee5\u5916\u7684\u57df\u53d1\u51fa\u8bf7\u6c42\u3002<\/p>\n<h2>JSONP\u6ce8\u5165\u7684\u8d77\u6e90\u5386\u53f2\u548c\u9996\u6b21\u63d0\u53ca<\/h2>\n<p>JSONP \u7684\u6982\u5ff5\u53ef\u4ee5\u8ffd\u6eaf\u5230\u65e9\u671f\u7684 Web \u5f00\u53d1\u65f6\u4ee3\uff0c\u5f53\u65f6\u540c\u6e90\u7b56\u7565\u7ed9\u7f51\u7ad9\u4e4b\u95f4\u7684\u8de8\u6e90\u901a\u4fe1\u5e26\u6765\u4e86\u6311\u6218\u3002 JSONP \u6700\u521d\u662f\u4f5c\u4e3a\u4e00\u79cd\u89e3\u51b3\u65b9\u6cd5\u5f15\u5165\u7684\uff0c\u4ee5\u5b89\u5168\u5730\u542f\u7528\u8de8\u57df\u8bf7\u6c42\u3002\u5728\u5b89\u5168\u4e0a\u4e0b\u6587\u4e2d\u9996\u6b21\u63d0\u53ca JSONP \u6ce8\u5165\u53ef\u4ee5\u8ffd\u6eaf\u5230 2000 \u5e74\u4ee3\u4e2d\u671f\uff0c\u5f53\u65f6\u5b89\u5168\u7814\u7a76\u4eba\u5458\u5f00\u59cb\u8bc6\u522b\u5176\u6f5c\u5728\u98ce\u9669\u548c\u5f71\u54cd\u3002<\/p>\n<h2>\u6709\u5173 JSONP \u6ce8\u5165\u7684\u8be6\u7ec6\u4fe1\u606f\uff1a\u6269\u5c55\u4e3b\u9898 JSONP \u6ce8\u5165<\/h2>\n<p>JSONP \u6ce8\u5165\u662f\u653b\u51fb\u8005\u5e38\u7528\u7684\u4e00\u79cd\u6280\u672f\uff0c\u7528\u4e8e\u5728\u6ca1\u6709\u9002\u5f53\u5b89\u5168\u63aa\u65bd\u7684\u60c5\u51b5\u4e0b\u5229\u7528\u5305\u542b JSONP \u7aef\u70b9\u7684\u7f51\u7ad9\u3002\u5b83\u5229\u7528 JSONP \u8bf7\u6c42\u662f\u901a\u8fc7\u52a8\u6001\u521b\u5efa\u811a\u672c\u6807\u7b7e\u6765\u6267\u884c\u7684\u4e8b\u5b9e\uff0c\u4ece\u800c\u53ef\u4ee5\u4ece\u53e6\u4e00\u4e2a\u57df\u52a0\u8f7d\u5916\u90e8 JavaScript \u4ee3\u7801\u3002\u8fd9\u5141\u8bb8\u653b\u51fb\u8005\u5c06\u6076\u610f JavaScript \u4ee3\u7801\u6ce8\u5165\u53d7\u5bb3\u8005\u7684\u6d4f\u89c8\u5668\u5e76\u4ee3\u8868\u4ed6\u4eec\u6267\u884c\u64cd\u4f5c\u3002<\/p>\n<p>JSONP\u6ce8\u5165\u653b\u51fb\u7684\u5178\u578b\u5de5\u4f5c\u6d41\u7a0b\u5305\u62ec\u4ee5\u4e0b\u6b65\u9aa4\uff1a<\/p>\n<ol>\n<li>\n<p>\u653b\u51fb\u8005\u8bc6\u522b\u76ee\u6807\u7f51\u7ad9\u4e0a\u6613\u53d7\u653b\u51fb\u7684 JSONP \u7aef\u70b9\uff0c\u901a\u5e38\u5305\u542b\u7528\u6237\u7279\u5b9a\u7684\u6570\u636e\u6216\u8eab\u4efd\u9a8c\u8bc1\u4ee4\u724c\u3002<\/p>\n<\/li>\n<li>\n<p>\u653b\u51fb\u8005\u5236\u4f5c\u4e00\u4e2a\u5305\u542b\u6076\u610f\u8d1f\u8f7d\u7684\u7279\u5236 URL\uff0c\u4f8b\u5982\u6267\u884c\u4efb\u610f\u4ee3\u7801\u7684\u56de\u8c03\u51fd\u6570\u3002<\/p>\n<\/li>\n<li>\n<p>\u53d7\u5bb3\u8005\u8bbf\u95ee\u7531\u653b\u51fb\u8005\u63a7\u5236\u7684\u9875\u9762\uff0c\u5176\u4e2d\u5305\u542b\u4ee5\u7cbe\u5fc3\u8bbe\u8ba1\u7684 URL \u4f5c\u4e3a\u6e90\u7684\u811a\u672c\u6807\u8bb0\u3002<\/p>\n<\/li>\n<li>\n<p>\u53d7\u5bb3\u8005\u7684\u6d4f\u89c8\u5668\u4ece\u653b\u51fb\u8005\u7684\u57df\u52a0\u8f7d\u811a\u672c\uff0c\u5728\u76ee\u6807\u7f51\u7ad9\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u6076\u610f\u4ee3\u7801\u3002<\/p>\n<\/li>\n<li>\n<p>\u653b\u51fb\u8005\u672a\u7ecf\u6388\u6743\u8bbf\u95ee\u654f\u611f\u6570\u636e\u3001\u4ee3\u8868\u53d7\u5bb3\u8005\u6267\u884c\u64cd\u4f5c\u6216\u8fdb\u4e00\u6b65\u5229\u7528\u7f51\u7ad9\u4e2d\u7684\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>JSONP\u6ce8\u5165\u7684\u5185\u90e8\u7ed3\u6784\uff1aJSONP\u6ce8\u5165\u5982\u4f55\u5de5\u4f5c<\/h2>\n<p>\u8981\u4e86\u89e3 JSONP \u6ce8\u5165\u7684\u5de5\u4f5c\u539f\u7406\uff0c\u7406\u89e3 JSONP \u8bf7\u6c42\u548c\u54cd\u5e94\u7684\u7ed3\u6784\u81f3\u5173\u91cd\u8981\uff1a<\/p>\n<ul>\n<li>JSONP \u8bf7\u6c42\uff1a\u5ba2\u6237\u7aef\u4ee3\u7801\u901a\u8fc7\u4f7f\u7528 JSONP \u7aef\u70b9 URL \u521b\u5efa\u811a\u672c\u6807\u8bb0\u6765\u53d1\u8d77 JSONP \u8bf7\u6c42\u3002\u8be5 URL \u901a\u5e38\u5305\u542b\u4e00\u4e2a\u56de\u8c03\u53c2\u6570\uff0c\u5b83\u662f\u5ba2\u6237\u7aef\u5b9a\u4e49\u7684\u7528\u4e8e\u5904\u7406\u54cd\u5e94\u7684 JavaScript \u51fd\u6570\u3002<\/li>\n<\/ul>\n<pre><div class=\"bg-black rounded-md mb-4\"><div class=\"flex items-center relative text-gray-200 bg-gray-800 px-4 py-2 text-xs font-sans justify-between rounded-t-md\"><span>html<\/span><button class=\"flex ml-auto gap-2\"><svg stroke=\"currentColor\" fill=\"none\" stroke-width=\"2\" viewbox=\"0 0 24 24\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"h-4 w-4\" height=\"1em\" width=\"1em\" ><path d=\"M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2\"><\/path><rect x=\"8\" y=\"2\" width=\"8\" height=\"4\" rx=\"1\" ry=\"1\"><\/rect><\/svg>\u590d\u5236\u4ee3\u7801<\/button><\/div><div class=\"p-4 overflow-y-auto\"><code class=\"!whitespace-pre hljs language-html\" data-no-translation=\"\"><span class=\"hljs-tag\">&lt;<span class=\"hljs-name\">script<\/span> <span class=\"hljs-attr\">src<\/span>=<span class=\"hljs-string\">\"https:\/\/example.com\/data?callback=myCallbackFunction\"<\/span>&gt;<\/span><span class=\"hljs-tag\">&lt;\/<span class=\"hljs-name\">script<\/span>&gt;<\/span>\n<\/code><\/div><\/div><\/pre>\n<ul>\n<li>JSONP \u54cd\u5e94\uff1a\u670d\u52a1\u5668\u4f7f\u7528\u5c01\u88c5\u5728\u6307\u5b9a\u56de\u8c03\u51fd\u6570\u5185\u7684 JavaScript \u4ee3\u7801\u8fdb\u884c\u54cd\u5e94\u3002<\/li>\n<\/ul>\n<pre><div class=\"bg-black rounded-md mb-4\"><div class=\"flex items-center relative text-gray-200 bg-gray-800 px-4 py-2 text-xs font-sans justify-between rounded-t-md\"><span>javascript<\/span><button class=\"flex ml-auto gap-2\"><svg stroke=\"currentColor\" fill=\"none\" stroke-width=\"2\" viewbox=\"0 0 24 24\" stroke-linecap=\"round\" stroke-linejoin=\"round\" class=\"h-4 w-4\" height=\"1em\" width=\"1em\" ><path d=\"M16 4h2a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2V6a2 2 0 0 1 2-2h2\"><\/path><rect x=\"8\" y=\"2\" width=\"8\" height=\"4\" rx=\"1\" ry=\"1\"><\/rect><\/svg>\u590d\u5236\u4ee3\u7801<\/button><\/div><div class=\"p-4 overflow-y-auto\"><code class=\"!whitespace-pre hljs language-javascript\" data-no-translation=\"\"><span class=\"hljs-title function_\">myCallbackFunction<\/span>({ <span class=\"hljs-string\">\"name\"<\/span>: <span class=\"hljs-string\">\"John\"<\/span>, <span class=\"hljs-string\">\"age\"<\/span>: <span class=\"hljs-number\">30<\/span> });\n<\/code><\/div><\/div><\/pre>\n<p>\u670d\u52a1\u5668\u7684\u54cd\u5e94\u4f5c\u4e3a\u5ba2\u6237\u7aef\u4ee3\u7801\u7684\u4e00\u90e8\u5206\u7acb\u5373\u6267\u884c\uff0c\u5141\u8bb8\u7f51\u7ad9\u8bbf\u95ee\u63a5\u6536\u5230\u7684\u6570\u636e\u3002\u7136\u800c\uff0c\u8fd9\u4e5f\u5e26\u6765\u4e86\u4e00\u4e2a\u5b89\u5168\u6f0f\u6d1e\uff0c\u56e0\u4e3a\u4efb\u4f55\u4ee3\u7801\u90fd\u53ef\u4ee5\u4f5c\u4e3a\u54cd\u5e94\u6ce8\u5165\uff0c\u4ece\u800c\u5bfc\u81f4 JSONP \u6ce8\u5165\u3002<\/p>\n<h2>JSONP\u6ce8\u5165\u5173\u952e\u7279\u5f81\u5206\u6790<\/h2>\n<p>JSONP \u6ce8\u5165\u56e0\u5176\u4ee5\u4e0b\u5173\u952e\u7279\u6027\u800c\u8131\u9896\u800c\u51fa\uff1a<\/p>\n<ol>\n<li>\n<p>\u8de8\u57df\u8bf7\u6c42\uff1aJSONP \u5141\u8bb8\u8de8\u57df\u8bf7\u6c42\u800c\u4e0d\u8fdd\u53cd\u540c\u6e90\u7b56\u7565\uff0c\u8fd9\u4f7f\u5176\u5bf9\u4e8e\u5408\u6cd5\u7528\u4f8b\u5f88\u6709\u7528\uff0c\u4f46\u5982\u679c\u6ca1\u6709\u5f97\u5230\u9002\u5f53\u7684\u4fdd\u62a4\uff0c\u4e5f\u53ef\u80fd\u88ab\u5229\u7528\u3002<\/p>\n<\/li>\n<li>\n<p>\u5ba2\u6237\u7aef\u6267\u884c\uff1aJSONP \u54cd\u5e94\u76f4\u63a5\u5728\u5ba2\u6237\u7aef\u6267\u884c\uff0c\u5bfc\u81f4\u6267\u884c\u4efb\u4f55\u6ce8\u5165\u7684\u4ee3\u7801\uff0c\u8fd9\u53ef\u80fd\u4f1a\u5e26\u6765\u91cd\u5927\u7684\u5b89\u5168\u98ce\u9669\u3002<\/p>\n<\/li>\n<li>\n<p>\u7f3a\u4e4f\u5b89\u5168\u6027\uff1aJSONP \u7684\u8bbe\u8ba1\u76ee\u7684\u662f\u4e3a\u4e86\u6613\u7528\u6027\u800c\u4e0d\u662f\u5b89\u5168\u6027\uff0c\u5982\u679c\u6ca1\u6709\u5145\u5206\u4fdd\u62a4\uff0c\u5c31\u4f1a\u5bfc\u81f4\u6f5c\u5728\u7684\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>JSONP \u6ce8\u5165\u7684\u7c7b\u578b<\/h2>\n<p>JSONP \u6ce8\u5165\u4e3b\u8981\u6709\u4e24\u79cd\u7c7b\u578b\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u6570\u636e\u8bbf\u95ee JSONP \u6ce8\u5165\uff1a<\/strong> \u5728\u8fd9\u79cd\u7c7b\u578b\u4e2d\uff0c\u653b\u51fb\u8005\u5229\u7528 JSONP \u7aef\u70b9\u6765\u8bbf\u95ee\u76ee\u6807\u7f51\u7ad9\u7684\u654f\u611f\u6570\u636e\u3002\u4f8b\u5982\uff0c\u5982\u679c\u7f51\u7ad9\u5305\u542b\u68c0\u7d22\u7528\u6237\u8be6\u7ec6\u4fe1\u606f\u7684\u7aef\u70b9\uff0c\u5219\u653b\u51fb\u8005\u53ef\u4ee5\u64cd\u7eb5\u56de\u8c03\u51fd\u6570\u6765\u68c0\u7d22\u6b64\u4fe1\u606f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>JavaScript \u4ee3\u7801\u6ce8\u5165\uff1a<\/strong> \u5728\u8fd9\u91cc\uff0c\u653b\u51fb\u8005\u5c06\u6076\u610f JavaScript \u4ee3\u7801\u6ce8\u5165\u5230 JSONP \u54cd\u5e94\u4e2d\u3002\u7136\u540e\uff0c\u8be5\u4ee3\u7801\u5728\u76ee\u6807\u7f51\u7ad9\u7684\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\uff0c\u53ef\u80fd\u5141\u8bb8\u653b\u51fb\u8005\u4ee3\u8868\u53d7\u5bb3\u8005\u6267\u884c\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002<\/p>\n<\/li>\n<\/ol>\n<p>\u4e0b\u9762\u662f\u4e00\u4e2a\u6bd4\u8f83\u8868\uff0c\u7a81\u51fa\u663e\u793a\u4e86\u8fd9\u4e24\u79cd\u7c7b\u578b\u4e4b\u95f4\u7684\u4e3b\u8981\u533a\u522b\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>\u7c7b\u578b<\/th>\n<th>\u5ba2\u89c2\u7684<\/th>\n<th>\u7ed3\u679c<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u6570\u636e\u8bbf\u95ee JSONP \u6ce8\u5165<\/td>\n<td>\u8bbf\u95ee\u654f\u611f\u6570\u636e<\/td>\n<td>\u68c0\u7d22\u7528\u6237\u7279\u5b9a\u4fe1\u606f<\/td>\n<\/tr>\n<tr>\n<td>JavaScript \u4ee3\u7801\u6ce8\u5165<\/td>\n<td>\u6267\u884c\u6076\u610f JavaScript \u4ee3\u7801<\/td>\n<td>\u5728\u76ee\u6807\u7f51\u7ad9\u4e0a\u8fdb\u884c\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>JSONP\u6ce8\u5165\u7684\u4f7f\u7528\u65b9\u6cd5\u3001\u4f7f\u7528\u4e2d\u76f8\u5173\u95ee\u9898\u53ca\u89e3\u51b3\u65b9\u6848<\/h2>\n<h3>JSONP\u6ce8\u5165\u7684\u4f7f\u7528\u65b9\u6cd5\uff1a<\/h3>\n<ol>\n<li>\n<p><strong>\u6570\u636e\u6cc4\u9732\uff1a<\/strong> \u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528 JSONP \u6ce8\u5165\u6765\u8bbf\u95ee\u654f\u611f\u6570\u636e\uff0c\u4f8b\u5982\u7528\u6237\u914d\u7f6e\u6587\u4ef6\u3001\u7535\u5b50\u90ae\u4ef6\u5730\u5740\u6216\u8eab\u4efd\u9a8c\u8bc1\u4ee4\u724c\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5e10\u6237\u63a5\u7ba1\uff1a<\/strong> \u901a\u8fc7\u6ce8\u5165 JavaScript \u4ee3\u7801\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u4ee3\u8868\u7528\u6237\u6267\u884c\u64cd\u4f5c\uff0c\u4ece\u800c\u53ef\u80fd\u5bfc\u81f4\u5e10\u6237\u6cc4\u9732\u3002<\/p>\n<\/li>\n<\/ol>\n<h3>\u95ee\u9898\u53ca\u5176\u89e3\u51b3\u65b9\u6848\uff1a<\/h3>\n<ol>\n<li>\n<p><strong>\u9a8c\u8bc1\u4e0d\u5f53\uff1a<\/strong> \u56de\u8c03\u53c2\u6570\u7684\u8f93\u5165\u9a8c\u8bc1\u4e0d\u5145\u5206\u53ef\u80fd\u4f1a\u5bfc\u81f4 JSONP \u6ce8\u5165\u3002\u5f00\u53d1\u4eba\u5458\u5e94\u8be5\u9a8c\u8bc1\u548c\u6e05\u7406\u7528\u6237\u8f93\u5165\u4ee5\u9632\u6b62\u56de\u8c03\u64cd\u4f5c\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u7f3a\u4e4f\u5b89\u5168\u7aef\u70b9\uff1a<\/strong> JSONP \u7aef\u70b9\u5e94\u5f97\u5230\u5145\u5206\u4fdd\u62a4\uff0c\u5e76\u4ec5\u9650\u4e8e\u53d7\u4fe1\u4efb\u7684\u57df\u3002\u5b9e\u65bd\u4e25\u683c\u7684 CORS\uff08\u8de8\u6e90\u8d44\u6e90\u5171\u4eab\uff09\u7b56\u7565\u53ef\u4ee5\u51cf\u8f7b JSONP \u6ce8\u5165\u98ce\u9669\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u8fc7\u65f6\u7684 JSONP \u7528\u6cd5\uff1a<\/strong> JSONP \u5b58\u5728\u5c40\u9650\u6027\u548c\u5b89\u5168\u98ce\u9669\u3002\u6211\u4eec\u9f13\u52b1\u5f00\u53d1\u4eba\u5458\u4f7f\u7528\u66f4\u73b0\u4ee3\u3001\u66f4\u5b89\u5168\u7684\u66ff\u4ee3\u65b9\u6848\uff0c\u4f8b\u5982 CORS \u548c JSON Web \u4ee4\u724c (JWT) \u6765\u8fdb\u884c\u8de8\u57df\u901a\u4fe1\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u4e3b\u8981\u7279\u70b9\u53ca\u4e0e\u540c\u7c7b\u672f\u8bed\u7684\u5176\u4ed6\u6bd4\u8f83<\/h2>\n<p>\u4ee5\u4e0b\u662f JSONP \u6ce8\u5165\u4e0e\u7c7b\u4f3c\u672f\u8bed\u6216\u6f0f\u6d1e\u4e4b\u95f4\u7684\u6bd4\u8f83\u8868\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>\u5b66\u671f<\/th>\n<th>\u63cf\u8ff0<\/th>\n<th>\u533a\u522b<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>JSONP\u6ce8\u5165<\/td>\n<td>\u5229\u7528 JSONP \u7aef\u70b9\u8fdb\u884c\u4ee3\u7801\u6ce8\u5165<\/td>\n<td>\u7279\u5b9a\u4e8e JSONP \u8bf7\u6c42\u548c\u54cd\u5e94<\/td>\n<\/tr>\n<tr>\n<td>\u8de8\u7ad9\u811a\u672c (XSS)<\/td>\n<td>\u5c06\u6076\u610f\u811a\u672c\u6ce8\u5165\u7f51\u9875<\/td>\n<td>\u9488\u5bf9\u7f51\u9875\u4e0a\u4efb\u4f55\u6613\u53d7\u653b\u51fb\u7684\u8f93\u5165<\/td>\n<\/tr>\n<tr>\n<td>\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020 (CSRF)<\/td>\n<td>\u4ee3\u8868\u7528\u6237\u4f2a\u9020\u672a\u7ecf\u6388\u6743\u7684\u8bf7\u6c42<\/td>\n<td>\u5229\u7528\u7528\u6237\u5bf9\u53d7\u4fe1\u4efb\u7f51\u7ad9\u7684\u4fe1\u4efb<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4e0e JSONP \u6ce8\u5165\u76f8\u5173\u7684\u672a\u6765\u524d\u666f\u548c\u6280\u672f<\/h2>\n<p>\u968f\u7740Web\u5b89\u5168\u7684\u4e0d\u65ad\u53d1\u5c55\uff0cJSONP\u7684\u4f7f\u7528\u7531\u4e8e\u5176\u56fa\u6709\u7684\u5b89\u5168\u98ce\u9669\u800c\u9010\u6e10\u51cf\u5c11\u3002\u5f00\u53d1\u4eba\u5458\u6b63\u5728\u8f6c\u5411\u66f4\u5b89\u5168\u7684\u901a\u4fe1\u6280\u672f\uff0c\u4f8b\u5982 CORS\u3001\u5177\u6709\u9002\u5f53\u5b89\u5168\u6807\u5934\u7684 Fetch API\uff0c\u4ee5\u53ca\u4f7f\u7528 JSON Web \u4ee4\u724c (JWT) \u8fdb\u884c\u8de8\u57df\u8eab\u4efd\u9a8c\u8bc1\u3002<\/p>\n<p>\u6b64\u5916\uff0cWeb \u6d4f\u89c8\u5668\u5b89\u5168\u548c\u5b89\u5168\u6846\u67b6\u7684\u8fdb\u6b65\u4f7f\u5f97\u653b\u51fb\u8005\u5229\u7528 JSONP \u6ce8\u5165\u6f0f\u6d1e\u53d8\u5f97\u66f4\u5177\u6311\u6218\u6027\u3002\u968f\u7740\u5b89\u5168\u63aa\u65bd\u7684\u6539\u8fdb\uff0c\u653b\u51fb\u8005\u53ef\u80fd\u4f1a\u5c06\u6ce8\u610f\u529b\u8f6c\u5411\u66f4\u65b0\u7684\u3001\u5b89\u5168\u6027\u8f83\u4f4e\u7684\u901a\u4fe1\u534f\u8bae\u3002<\/p>\n<h2>\u5982\u4f55\u4f7f\u7528\u4ee3\u7406\u670d\u52a1\u5668\u6216\u5982\u4f55\u5c06\u4ee3\u7406\u670d\u52a1\u5668\u4e0e JSONP \u6ce8\u5165\u5173\u8054<\/h2>\n<p>\u4ee3\u7406\u670d\u52a1\u5668\u5728\u589e\u5f3a\u6d4f\u89c8\u4e92\u8054\u7f51\u65f6\u7684\u5b89\u5168\u6027\u548c\u9690\u79c1\u65b9\u9762\u53d1\u6325\u7740\u81f3\u5173\u91cd\u8981\u7684\u4f5c\u7528\u3002\u5f53\u6d89\u53ca JSONP \u6ce8\u5165\u65f6\uff0c\u914d\u7f6e\u826f\u597d\u7684\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u5145\u5f53\u9488\u5bf9\u6b64\u7c7b\u653b\u51fb\u7684\u9644\u52a0\u9632\u5fa1\u5c42\u3002\u4ee5\u4e0b\u662f\u4ee3\u7406\u670d\u52a1\u5668\u4e0e JSONP \u6ce8\u5165\u5173\u8054\u7684\u65b9\u5f0f\uff1a<\/p>\n<ol>\n<li>\n<p><strong>\u8bf7\u6c42\u8fc7\u6ee4\uff1a<\/strong> \u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u914d\u7f6e\u4e3a\u8fc7\u6ee4\u4f20\u5165\u7684 JSONP \u8bf7\u6c42\u5e76\u963b\u6b62\u6076\u610f\u8bf7\u6c42\u3002\u8fd9\u6709\u52a9\u4e8e\u9632\u6b62 JSONP \u6ce8\u5165\u5c1d\u8bd5\u5230\u8fbe\u76ee\u6807\u7f51\u7ad9\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u54cd\u5e94\u68c0\u67e5\uff1a<\/strong> \u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u5206\u6790 JSONP \u54cd\u5e94\u4ee5\u67e5\u627e\u4efb\u4f55\u4ee3\u7801\u6ce8\u5165\u6216\u6076\u610f\u8d1f\u8f7d\u7684\u8ff9\u8c61\u3002\u5982\u679c\u68c0\u6d4b\u5230\uff0c\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u963b\u6b62\u54cd\u5e94\u5e76\u4fdd\u62a4\u7528\u6237\u514d\u53d7\u6f5c\u5728\u4f24\u5bb3\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u8de8\u6e90\u653f\u7b56\uff1a<\/strong> \u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u5f3a\u5236\u6267\u884c\u4e25\u683c\u7684\u8de8\u57df\u7b56\u7565\uff0c\u9650\u5236\u53ef\u4ee5\u5411\u76ee\u6807\u7f51\u7ad9\u53d1\u51fa JSONP \u8bf7\u6c42\u7684\u57df\u3002\u8fd9\u53ef\u4ee5\u6700\u5927\u9650\u5ea6\u5730\u964d\u4f4e JSONP \u6ce8\u5165\u653b\u51fb\u7684\u98ce\u9669\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<p>\u6709\u5173 JSONP \u6ce8\u5165\u548c Web \u5b89\u5168\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u8003\u8651\u8bbf\u95ee\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n<ol>\n<li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/JSONP_Injection\" target=\"_new\" rel=\"noopener nofollow\">OWASP JSONP \u6ce8\u5165<\/a><\/li>\n<li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Methods\/JSONP\" target=\"_new\" rel=\"noopener nofollow\">Mozilla \u5f00\u53d1\u8005\u7f51\u7edc (MDN) \u2013 JSONP<\/a><\/li>\n<li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/CORS\" target=\"_new\" rel=\"noopener nofollow\">\u8de8\u57df\u8d44\u6e90\u5171\u4eab (CORS)<\/a><\/li>\n<li><a href=\"https:\/\/jwt.io\/\" target=\"_new\" rel=\"noopener nofollow\">JSON Web \u4ee4\u724c (JWT)<\/a><\/li>\n<li><a href=\"https:\/\/www.cloudflare.com\/learning\/cdn\/glossary\/proxy-server\/\" target=\"_new\" rel=\"noopener nofollow\">\u4ee3\u7406\u670d\u52a1\u5668\u89e3\u91ca<\/a><\/li>\n<\/ol>\n<p>\u901a\u8fc7\u53ca\u65f6\u4e86\u89e3\u4e0e JSONP \u6ce8\u5165\u76f8\u5173\u7684\u98ce\u9669\u548c\u5bf9\u7b56\uff0c\u5f00\u53d1\u4eba\u5458\u548c\u7f51\u7ad9\u7ba1\u7406\u5458\u53ef\u4ee5\u786e\u4fdd\u5176 Web \u5e94\u7528\u7a0b\u5e8f\u7684\u5b89\u5168\u5e76\u4fdd\u62a4\u7528\u6237\u514d\u53d7\u6f5c\u5728\u5a01\u80c1\u3002<\/p>","protected":false},"featured_media":477750,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477749","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>JSONP Injection: A Comprehensive Guide<\/mark>","faq_items":[{"question":"What is JSONP injection?","answer":"<p>JSONP injection is a web security vulnerability that allows attackers to manipulate a website's JSONP endpoint to execute arbitrary code or steal sensitive data from users. It takes advantage of permissive JSONP requests, bypassing the same-origin policy that restricts cross-origin communication.<\/p>"},{"question":"How did JSONP injection originate?","answer":"<p>JSONP was introduced as a workaround for cross-origin communication challenges in early web development. The first mention of JSONP injection in a security context dates back to the mid-2000s when security researchers identified its potential risks.<\/p>"},{"question":"How does JSONP injection work?","answer":"<p>JSONP injection exploits JSONP's nature by dynamically creating script tags to load external JavaScript code from another domain. Attackers craft malicious URLs with callback functions that execute code on the victim's browser, gaining unauthorized access to data or performing actions on their behalf.<\/p>"},{"question":"What are the key features of JSONP injection?","answer":"<p>JSONP injection is characterized by its ability to enable cross-domain requests, client-side execution, and its lack of inherent security measures. This makes it both useful and vulnerable for website owners.<\/p>"},{"question":"What types of JSONP injection exist?","answer":"<p>There are two main types of JSONP injection: Data Access JSONP Injection, where attackers access sensitive data, and JavaScript Code Injection, where they inject malicious code to perform unauthorized actions.<\/p>"},{"question":"How can JSONP injection be used, and what are the related problems and solutions?","answer":"<p>JSONP injection can be used for data leakage and account takeover. To address this vulnerability, developers should implement proper validation, secure JSONP endpoints, and consider more modern alternatives like CORS and JSON Web Tokens.<\/p>"},{"question":"How does JSONP injection compare to similar terms?","answer":"<p>JSONP injection is distinct from Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) in terms of its specific focus on JSONP requests and responses.<\/p>"},{"question":"What are the future perspectives and technologies related to JSONP injection?","answer":"<p>As web security evolves, developers are moving away from JSONP in favor of more secure communication techniques like CORS and JWT. Improved browser security and frameworks are also making it harder for attackers to exploit JSONP vulnerabilities.<\/p>"},{"question":"How are proxy servers associated with JSONP injection?","answer":"<p>Proxy servers can enhance security by filtering incoming JSONP requests, inspecting responses for malicious content, and enforcing strict cross-origin policies to prevent JSONP injection attacks.<\/p>"},{"question":"Where can I find more information about JSONP injection and web security?","answer":"<p>For more in-depth information about JSONP injection and web security, consider visiting the following resources:<\/p><ul><li><a href=\"https:\/\/owasp.org\/www-community\/attacks\/JSONP_Injection\" target=\"_new\">OWASP JSONP Injection<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Methods\/JSONP\" target=\"_new\">Mozilla Developer Network (MDN) - JSONP<\/a><\/li><li><a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/CORS\" target=\"_new\">Cross-Origin Resource Sharing (CORS)<\/a><\/li><li><a href=\"https:\/\/jwt.io\/\" target=\"_new\">JSON Web Tokens (JWT)<\/a><\/li><li><a href=\"https:\/\/www.cloudflare.com\/learning\/cdn\/glossary\/proxy-server\/\" target=\"_new\">Proxy Servers Explained<\/a><\/li><\/ul><p>Stay informed and protect yourself from potential threats with our comprehensive guide on JSONP injection at OneProxy!<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477749\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/477750"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=477749"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}