CORS in embedded javascript -

i'm intending add security our javascript code gets embedded on other sites - eg: analytics code.

the user copies 4-5 lines of code , puts on site. code downloads real script next step.

i have been recommended use cors instead of current jsonp calls can restrict domains.

as understand, cors work if html page add scripts needs add access domains , if add access domains the js file, wouldn't work.

is cors final js or html page intending use script?

edit:

since it's confusing users, have made more simple.

html in domain adds script domain b google analytics. can add access-domains: while rendering js or should html add access-domains in response?

there explanation wiki question:

cors can used modern alternative jsonp pattern. while jsonp supports get request method, cors supports other types of http requests. using cors enables web programmer use regular xmlhttprequest, supports better error handling jsonp. on other hand, jsonp works on legacy browsers predate cors support. cors supported modern web browsers. also, while jsonp can cause cross-site scripting (xss) issues external site compromised, cors allows websites manually parse responses ensure security.

as understand, cors work if html page add scripts needs add access domains

you can access domains via:

access-control-allow-origin: * 

also cors has good support.

p.s. ie8-9 has own imlementation xdomainrequest.