{"record":{"id":"19554bb867d944ba","repo":"angular/angular","slug":"jsonp-support-is-deprecated-as-it-can-cause-xss-vu","errorCode":null,"errorMessage":"JSONP support is deprecated as it can cause XSS vulnerabilities, and will be removed in a future version of Angular. Please use standard HTTP requests instead.","messagePattern":"JSONP support is deprecated as it can cause XSS vulnerabilities, and will be removed in a future version of Angular\\. Please use standard HTTP requests instead\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"packages/common/http/src/jsonp.ts","lineNumber":110,"sourceCode":" * @see {@link HttpXhrBackend}\n *\n * @publicApi\n * @deprecated 22.1 JSONP is deprecated as it can cause XSS vulnerabilities. Use standard HTTP requests instead. Intent to remove in future versions of Angular.\n */\n@Injectable()\nexport class JsonpClientBackend implements HttpBackend {\n  /**\n   * A resolved promise that can be used to schedule microtasks in the event handlers.\n   */\n  private readonly resolvedPromise = Promise.resolve();\n  private readonly nonce = inject(CSP_NONCE, {optional: true});\n\n  constructor(\n    private callbackMap: JsonpCallbackContext,\n    @Inject(DOCUMENT) private document: any,\n  ) {\n    if (typeof ngDevMode === 'undefined' || ngDevMode) {\n      console.warn(\n        'JSONP support is deprecated as it can cause XSS vulnerabilities, and will be removed ' +\n          'in a future version of Angular. Please use standard HTTP requests instead.',\n      );\n    }\n  }\n\n  /**\n   * Get the name of the next callback method, by incrementing the global `nextRequestId`.\n   */\n  private nextCallback(): string {\n    return `ng_jsonp_callback_${nextRequestId++}`;\n  }\n\n  /**\n   * Processes a JSONP request and returns an event stream of the results.\n   * @param req The request object.\n   * @returns An observable of the response events.\n   *","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/angular/angular/blob/51cb07e98081ab7e4e84a9e0949266a8e19cca84/packages/common/http/src/jsonp.ts#L92-L128","documentation":"Constructing `JsonpClientBackend` — i.e., activating JSONP support in HttpClient via `provideHttpClient(withJsonpSupport())` or importing `HttpClientJsonpModule` — logs a dev-mode deprecation warning: JSONP will be removed because it works by injecting executable <script> tags, creating XSS exposure when the endpoint is untrusted. Angular recommends standard HTTP requests, which rely on CORS instead of script injection.","triggerScenarios":"Providing `withJsonpSupport()` (or `HttpClientJsonpModule`) in the app config; the warning fires in the `JsonpClientBackend` constructor in dev mode, as soon as the JSONP backend is instantiated (first `http.jsonp()` call or eager provider creation).","commonSituations":"Legacy enterprise apps consuming old third-party APIs that never sent CORS headers; upgrading such apps to modern Angular where removal is scheduled; teams discovering hidden JSONP usage only when the warning appears during a migration.","solutions":["Replace `http.jsonp()` calls with `http.get()` once the endpoint sends proper CORS headers (Access-Control-Allow-Origin)","If the third-party endpoint cannot change, proxy it through your own server/BFF that adds CORS headers, then use `http.get()`","Remove `provideHttpClient(withJsonpSupport())` / `HttpClientJsonpModule` once no `jsonp()` calls remain"],"exampleFix":"// before\nprovideHttpClient(withJsonpSupport());\nthis.http.jsonp('https://legacy.example.com/data', 'callback');\n\n// after\nprovideHttpClient(withFetch());\nthis.http.get<ApiResponse>('https://api.example.com/data'); // server sends CORS headers","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never use JSONP for new integrations; require CORS on APIs you consume","Proxy unchangeable legacy endpoints through your own backend instead","Grep for withJsonpSupport / HttpClientJsonpModule / http.jsonp during upgrades and remove them before the API is deleted"],"tags":["http","jsonp","deprecation","security","xss"],"backgroundTag":"deprecated-api-usage","analyzedSha":"51cb07e98081ab7e4e84a9e0949266a8e19cca84","analyzedAt":"2026-08-22T07:04:54.531Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}