# @eggjs/jsonp

> jsonp support for egg

Latest version **4.1.0** (published 2026-10-07) · MIT license · 0 weekly downloads

## Install

```sh
npm install @eggjs/jsonp
pnpm add @eggjs/jsonp
yarn add @eggjs/jsonp
bun add @eggjs/jsonp
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 4.1.0 |
| Published | 2026-10-07 |
| First published | 2025-01-11 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM |
| Node | >=22.18.0 |
| Dependencies | 1 |
| Unpacked size | 13.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| Author | dead-horse |
| Maintainers | gxkl, eggjs-admin, fengmk2, atian25, hyj1991, killagu, coolme200, akitasummer, elrrrrrrr, niania |
| Keywords | egg, egg-plugin, jsonp, security |

## Links

- npm: https://www.npmjs.com/package/@eggjs/jsonp
- Repository: https://github.com/eggjs/egg
- Homepage: https://github.com/eggjs/egg/tree/next/plugins/jsonp
- Issues: https://github.com/eggjs/egg/issues
- npm.io page: https://npm.io/package/@eggjs/jsonp

## Dependencies (1)

- [jsonp-body](https://npm.io/package/jsonp-body.md) ^2.0.0

## Alternatives

- [@mapbox/jsonlint-lines-primitives](https://npm.io/package/@mapbox/jsonlint-lines-primitives.md) — 5.3M weekly downloads
- [reftools](https://npm.io/package/reftools.md) — 3.5M weekly downloads
- [@hey-api/openapi-ts](https://npm.io/package/@hey-api/openapi-ts.md) — 3.5M weekly downloads
- [@mapbox/geojson-rewind](https://npm.io/package/@mapbox/geojson-rewind.md) — 2.4M weekly downloads
- [turbo-stream](https://npm.io/package/turbo-stream.md) — 1.7M weekly downloads

## Recent versions

- 4.1.0 (latest) — 2026-10-07
- 4.0.2-rc.1 (rc) — 2026-10-06
- 4.0.2-beta.27 (beta) — 2026-09-20
- 4.0.2 — 2026-10-06
- 4.0.2-rc.0 — 2026-09-23
- 4.0.2-beta.26 — 2026-08-07
- 4.0.2-beta.25 — 2026-07-13
- 4.0.2-beta.24 — 2026-07-12
- 4.0.2-beta.23 — 2026-07-11
- 4.0.2-beta.22 — 2026-07-11
- 4.0.2-beta.20 — 2026-07-09
- 4.0.2-beta.19 — 2026-06-29
- 4.0.2-beta.17 — 2026-06-28
- 4.0.2-beta.16 — 2026-06-26
- 4.0.2-beta.15 — 2026-06-26
- … 38 more at https://npm.io/package/@eggjs/jsonp/versions

## README

# @eggjs/jsonp

[![NPM version][npm-image]][npm-url]
[![Known Vulnerabilities][snyk-image]][snyk-url]
[![npm download][download-image]][download-url]
[![Node.js Version](https://img.shields.io/node/v/@eggjs/jsonp.svg?style=flat)](https://nodejs.org/en/download/)
[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)

[npm-image]: https://img.shields.io/npm/v/@eggjs/jsonp.svg?style=flat-square
[npm-url]: https://npmjs.org/package/@eggjs/jsonp
[snyk-image]: https://snyk.io/test/npm/@eggjs/jsonp/badge.svg?style=flat-square
[snyk-url]: https://snyk.io/test/npm/@eggjs/jsonp
[download-image]: https://img.shields.io/npm/dm/@eggjs/jsonp.svg?style=flat-square
[download-url]: https://npmjs.org/package/@eggjs/jsonp

An egg plugin for jsonp support.

## Usage

egg built-in plugin `jsonp` is enabled by default.

```ts
// {app_root}/config/plugin.ts

export default {
  jsonp: {
    enable: true,
  },
};
```

## Configuration

- {String|Array} callback - jsonp callback method key, default to `[ '_callback', 'callback' ]`
- {Number} limit - callback method name's max length, default to `50`
- {Boolean} csrf - enable csrf check or not. default to false
- {String|RegExp|Array} whiteList - referrer white list

if whiteList's type is `RegExp`, referrer must match `whiteList`, pay attention to the first `^` and last `/`.

```ts
export default {
  jsonp: {
    whiteList: /^https?:\/\/test.com\//,
  },
};

// matchs referrer:
// https://test.com/hello
// http://test.com/
```

if whiteList's type is `String` and starts with `.`:

```ts
export default {
  jsonp: {
    whiteList: '.test.com',
  },
};

// matchs domain test.com:
// https://test.com/hello
// http://test.com/

// matchs subdomain
// https://sub.test.com/hello
// http://sub.sub.test.com/
```

if whiteList's type is `String` and not starts with `.`:

```ts
export default {
  jsonp: {
    whiteList: 'sub.test.com',
  },
};

// only matchs domain sub.test.com:
// https://sub.test.com/hello
// http://sub.test.com/
```

whiteList also can be an array:

```ts
export default {
  jsonp: {
    whiteList: ['.foo.com', '.bar.com'],
  },
};
```

see [config/config.default.ts](https://github.com/eggjs/egg/blob/master/plugins/jsonp/src/config/config.default.ts) for more detail.

## API

- ctx.acceptJSONP - detect if response should be jsonp, readonly

## Example

### Standard Application Usage

In `app/router.ts`

```ts
// Create once and use in any router you want to support jsonp.
const jsonp = app.jsonp();

app.get('/default', jsonp, 'jsonp.index');
app.get('/another', jsonp, 'jsonp.another');

// Customize by create another jsonp middleware with specific configurations.
app.get('/customize', app.jsonp({ callback: 'fn' }), 'jsonp.customize');
```

### tegg HttpController Usage

TODO: TBD

## Questions & Suggestions

Please open an issue [here](https://github.com/eggjs/egg/issues).

## License

[MIT](LICENSE)

## Contributors

[![Contributors](https://contrib.rocks/image?repo=eggjs/egg)](https://github.com/eggjs/egg/graphs/contributors)

Made with [contributors-img](https://contrib.rocks).

---
_Source: https://npm.io/package/@eggjs/jsonp · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._