Should support returning a prefix to avoid JSON hijacking on GET requests.

ring-clojure / ring-json

Ring middleware for handling JSON

313 stars 47 forks source link

Should support returning a prefix to avoid JSON hijacking on GET requests. #14

Open JulianBirch opened 11 years ago

dyba commented 10 years ago

Can you explain what you mean by this @JulianBirch ?

weavejester commented 10 years ago

See JSON hijacking for a detailed explanation of this attack.

The author of this issue is proposing that we add an configurable prefix so a user can add something like while(1); to the beginning of their JSON.

JulianBirch commented 10 years ago

Exactly. On a related note, it's worth considering whether secure should be the default. I've got the same problem with cljs-ajax: secure by default is a good idea, but it would be a horribly breaking change.

weavejester commented 10 years ago

Adding a prefix is only necessary if the endpoint is using cookies for verification and returns an array. For standalone APIs or AJAX interfaces that use tokens, or for endpoints that return anything but an array, a prefix is unnecessary and something of a hindrance.