What are the JSON security concerns in web development?
6th January 2011
My answer to What are the JSON security concerns in web development? on Quora
Be very careful when implementing JSON-P for authenticated actions—evil third party sites could assemble URLs to your user’s private data and steal it. This attack has worked against Gmail in the past.
A few years ago there was a security issue where Mozilla browsers could be tricked in to leaking JSON arrays even if they weren’t wrapped in JSON-P—this has since been fixed, but it’s still a good idea to wrap your private JSON response in a JS comment and have your Ajax calling code remove those comments before eval()ing the JSON. This prevents external sites from taking advantage of newly discovered JSON execution vulnerabilities like the old Mozilla one.
If you are consuming JSON-P from another site, be VERY sure you can trust that site in the future, since you’re opening yourself up to a nasty XSS attack if they go rogue. Ideally you should be monitoring them to check if they suddenly turn evil one day (or their domain name gets hijacked).
Basically, make sure you have a deep understanding of the same-origin policy, JSON-P and XSS and you should be fine.
More recent articles
- Phoenix.new is Fly's entry into the prompt-driven app development space - 23rd June 2025
- Trying out the new Gemini 2.5 model family - 17th June 2025
- The lethal trifecta for AI agents: private data, untrusted content, and external communication - 16th June 2025