That's right. Check out JSONP for more info: https://en.wikipedia.org/wiki/JSONP

This was really common before CORS.