What is JSONP and why isn't it Ajax?

JSONP (JSON with Padding) was a workaround for cross-origin requests from the era before CORS existed. It exploits one gap in the same-origin policy: a <script> tag is allowed to load from any domain.

Instead of requesting data, you request executable code that happens to carry the data:

function handleData(data) {
  console.log(data);
}

const s = document.createElement("script");
s.src = "https://api.example.com/users?callback=handleData";
document.body.appendChild(s);

The server does not reply with JSON. It replies with a function call wrapping the JSON — that wrapper is the "padding":

handleData({ "id": 1, "name": "Mai" });

The browser executes it like any other script, and your function receives the data.

Why it is not Ajax

Ajax means an asynchronous HTTP request made from JavaScript via XMLHttpRequest or fetch(). JSONP uses neither. It is a script injection, which means:

• GET only. You cannot POST, set headers, or send a body.
• No status codes. A 404 or 500 just fails to load; you have to implement your own timeout to detect failure.
• No cancellation and no access to the response before it runs.

Do not use it today

The server's response runs as code with full access to your page. A compromised or malicious endpoint owns your site — there is no sandbox. Every browser in use now supports CORS, which solves the same problem safely and works with every HTTP method. Treat JSONP as something to recognise in legacy code and interviews, not something to write.