# Why shouldn't JSONP​ be used?
Source: https://tpiros.dev/blog/why-jsonp-shouldnt-be-used
[In a previous article](https://fullstack-developer.academy/what-is-cors/), we covered CORS requests: why they happen and how to deal with them. Sometimes when CORS comes up, people reach for JSONP (JSON with Padding) as a workaround. Let's talk about why that's a bad idea.
# CORS 101 - a quick recap
When a web application requests a resource from a domain you don't control, the browser might block you with `Failed to load resource: Origin * is not allowed by Access-Control-Allow-Origin.`. The browser is refusing access to that resource (typically an API endpoint).
> For more information read the article titled "[What is CORS?](https://fullstack-developer.academy/what-is-cors/)"
# An example implementation
Let's set up a scenario that triggers the CORS problem. Two Node.js files will do it: an API server and an HTTP server.
```javascript
// api.js
const express = require('express');
const app = express();
const port = 3000;
const apiHandler = (request, response) => {
response.json({ message: 'Hello World!' });
};
app.get('/api/hello', apiHandler);
app.listen(port, () => console.info(`API up on port ${port}.`));
// http-server.js
const http = require('http');
const path = require('path');
const fs = require('fs');
const port = 8080;
const httpServerHandler = (request, response) => {
response.writeHead(200);
response.write(fs.readFileSync(path.join(`${process.cwd()}/index.html`)));
response.end();
};
http.createServer(httpServerHandler).listen(port);
console.log(`HTTP Server is up on port ${port}`);
```
> Please note that this HTTP server is bare-bones. It also uses `fs.readFileSync`, a _blocking_ method you shouldn't use in production. For real work, grab an npm package for your web server.
Now we've got two Node.js processes: an API server on port 3000 and an HTTP server on port 8080. Under CORS rules, these count as separate origins, so the browser will block cross-requests.
Here's a simple HTML file that tries to make an AJAX request via jQuery:
```html
JSONP
```
Open the browser and navigate to `localhost:8080`. You'll hit the CORS message. That's the expected behaviour.
# JSONP
Let's see what JSONP does here. Notice something interesting in our `index.html`: we're already pulling in a resource from a different domain (the jQuery library from a CDN).
That works because browsers let you load resources through the `