Mobile applications (PhoneGap, Adobe AIR, Titanium, Native, etc.) have no restrictions on the same origin for XHR requests made by desktop browsers. They can make any cross-domain calls that they want. That's why it works great on the phone, not on the desktop.
JSONP works fine in both cases since it does not use XHR. It performs a cross-domain query using the <script> tag. Thus, it turns into a browser policy. JSONP can only work if the remote service returns data as a function that runs immediately.
Jason dean
source share