jQuery.getJSON uses ajax. http://api.jquery.com/jquery.getjson/
.ajax uses XMLHttpRequest
Web security chrome and other browsers blocks XMLHttpRequest to local files because it is a security issue.
Through the depth of security: local web pages
http://blog.chromium.org/2008/12/security-in-depth-local-web-pages.html
You receive an email from an attacker containing a web page as the application you are downloading.
You open a local web page in your browser.
The local web page creates an iframe, the source of which is https://mail.google.com/mail/ .
Since you are logged in to Gmail, the frame uploads messages to your inbox.
The local web page reads the contents of the frame using JavaScript to access frames [0] .document.documentElement.innerHTML. (An Internet web page cannot complete this step because it comes from a non-Gmail source; a policy of the same origin will result in a read for failure.)
The local web page puts the contents of your mailbox in and sends the data through the POST form to the attacker's web server. Now the attacker has your mailbox, which can be useful for sending spam or identify theft.
The solution for data that does not need a security policy of the same origin is complemented by json. Since jsonp is not a safe data format. Jsonp does not have policies of the same origin.
{ "one": "Singular sensation", "two": "Beady little eyes", "three": "Little birds pitch by my doorstep" } Mycallback ({ "one": "Singular sensation", "two": "Beady little eyes", "three": "Little birds pitch by my doorstep" });
Since with jsonp json is wrapped in a valid javascript function, it can be opened just like anyone who adds any javascript to the page.
var element = document.createElement("script"); element.src = "jsonp.js"; document.body.appendChild(element);
And your callback processes the data,
function Mycallback(jsondata) { }
This is functionally the same as the ajax request, but different because it is a jsonp request, which is actually simpler.
jQuery libs directly support jsonp, and http://api.jquery.com/jquery.getjson/ See an example using the Flickr JSONP API; unless double standards were known, they might not even notice that jsonp was being used.
(function() { var flickerAPI = "http://api.flickr.com/services/feeds/photos_public.gne?jsoncallback=?"; $.getJSON( flickerAPI, { tags: "mount rainier", tagmode: "any", format: "json" }) .done(function( data ) { $.each( data.items, function( i, item ) { $( "<img>" ).attr( "src", item.media.m ).appendTo( "#images" ); if ( i === 3 ) { return false; } }); }); })();
Local access to json can be enabled, but it does it differently depending on browswer.
Use --allow-file-access-from-files to include it in chrome. https://code.google.com/p/chromium/issues/detail?id=40787
FYI: they are working on encripted json http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-08 I am absolutely sure that there will be no method of using this locally. to make it really safe.