ASVS 5.0 requirement V3.5.6 says JSONP functionality must not be enabled anywhere in the application, to avoid Cross-Site Script Inclusion (XSSI) attacks. It is a Level 3 requirement.
Why it matters
JSONP predates CORS. A page loads <script src="https://api.example.com/data?callback=show"> and the server answers with show({...}), which runs as script in the calling page. That bypasses the same-origin policy by design: any site can include that script tag, and the browser attaches the user's cookies. If the data is private, the attacker's page receives it through its own show function.
It also lets an attacker control a function name that is echoed into JavaScript. A callback parameter that is not strictly validated can inject code.
How to implement it
Remove the callback handling and serve plain JSON with the right type, then use CORS for legitimate cross-origin reads, see V3.4.2.
// remove this pattern
app.get("/data", (req, res) => res.send(req.query.callback + "(" + JSON.stringify(data) + ")"));
// serve JSON only
app.get("/data", (req, res) => res.type("application/json").json(data));
In Spring, drop JsonpResponseBodyAdvice or any callback parameter support. In Express remove app.set("jsonp callback name") and any use of res.jsonp. Also ignore the callback query parameter entirely.
How to test it
curl -si "https://api.example.com/v1/data?callback=alert" | head -20
curl -si "https://api.example.com/v1/data?jsonp=alert" | head -20
The body must be plain JSON, with a JSON content type, not wrapped in alert(...). Search code and gateway config for res.jsonp, callback= and JSONP. Check third party libraries too.
Common mistakes
Leaving legacy endpoints. Old mobile or partner integrations keep JSONP alive.
Validating the callback instead of removing it. A safe name still enables cross-site reads.
Proxy or gateway adds it. Check infrastructure rules.
Quick check
What replaces JSONP?
CORS with a strict origin allowlist, as covered by V3.4.2.
Sources
- OWASP ASVS 5.0, requirement V3.5.6
- MDN: Cross-Origin Resource Sharing
