Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
fetch-jsonp
Advanced tools
JSONP is NOT supported in standard Fetch API, https://fetch.spec.whatwg.org.
fetch-jsonp provides you same API to fetch JSONP like native Fetch, also comes
with global fetchJsonp
function.
If you need a fetch
polyfill for old browsers, try github/fetch.
You can install with npm
.
npm install fetch-jsonp
IE8/9/10/11 does not support ES6 Promise, run this to polyfill the global environment at the beginning of your application.
require('es6-promise').polyfill();
JSONP only supports GET method, same as fetch-jsonp
.
fetchJsonp('/users.jsonp')
.then(function(response) {
return response.json()
}).then(function(json) {
console.log('parsed json', json)
}).catch(function(ex) {
console.log('parsing failed', ex)
})
fetchJsonp('/users.jsonp', {
jsonpCallback: 'custom_callback',
})
.then(function(response) {
return response.json()
}).then(function(json) {
console.log('parsed json', json)
}).catch(function(ex) {
console.log('parsing failed', ex)
})
json_
prefixfetchJsonp('/users.jsonp', {
jsonpCallbackFunction: 'function_name_of_jsonp_response'
})
.then(function(response) {
return response.json()
}).then(function(json) {
console.log('parsed json', json)
}).catch(function(ex) {
console.log('parsing failed', ex)
})
fetchJsonp('/users.jsonp', {
timeout: 3000,
})
.then(function(response) {
return response.json()
}).then(function(json) {
console.log('parsed json', json)
}).catch(function(ex) {
console.log('parsing failed', ex)
})
jsonpCallback
and jsonpCallbackFunction
There two functions can easily be confused with each other, but there is a clear distinction.
Default values are
jsonpCallback
, default value is callback
. It's the name of the callback parameterjsonpCallbackFunction
, default value is null
. It's the name of the callback function. In order to make it distinct, it's a random string with jsonp_
prefix like jsonp_1497658186785_39551
. Leave it blank if it's set by the server, set it explicitly if the callback function name is fixed.fetchJsonp('/users.jsonp', {
jsonpCallback: 'cb'
})
The request url will be /users.jsonp?cb=jsonp_1497658186785_39551
, and the server should respond with a function like:
jsonp_1497658186785_39551(
{ ...data here... }
)
fetchJsonp('/users.jsonp', {
jsonpCallbackFunction: 'search_results'
})
The request url will be /users.jsonp?callback=search_results
, and the server should always respond with a function named search_results
like:
search_results(
{ ...data here... }
)
.then(function(response) { return response.json(); })
in order to keep consistent with Fetch API.Uncaught SyntaxError: Unexpected token :
errorMore than likely, you are calling a JSON api, which does not support JSONP. The difference is that JSON api responds with an object like {"data": 123}
and will throw the error above when being executed as a function. On the other hand, JSONP will respond with a function wrapped object like jsonp_123132({data: 123})
.
Latest ✔ | Latest ✔ | 8+ ✔ | Latest ✔ | 6.1+ ✔ |
MIT
Thanks to github/fetch for bring Fetch to old browsers.
FAQs
Fetch JSONP like a boss using Fetch API
The npm package fetch-jsonp receives a total of 70,942 weekly downloads. As such, fetch-jsonp popularity was classified as popular.
We found that fetch-jsonp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.