Simon Willison’s Weblog

Wrong-headed impersonation. Kim Cameron discusses user absent authentication, and emphasises the importance of delegation using delegation coupons.

# 2:38 pm / authentication, delegation, delegationcoupons, identity, kimcameron

Dashcode review. “Dashcode is quite possibly the best non-Firebug Javascript environment I’ve ever used.” High praise indeed.

# 9:06 pm / dashcode, firebug, javascript, widgets

JSON is not as safe as people think it is. Joe Walker reminds us that even authenticated JSON served without a callback or variable assignment is vulnerable to CSRF in Firefox, thanks to that browser letting you redefine the Array constructor.

# 10:51 pm / csrf, joe-walker, json, security