Simon Willison’s Weblog

eval() Kerfuffle. The ability to read supposedly private variables in Firefox using a second argument to eval() will be removed in Firefox 3.1.

# 2nd July 2008, 9:24 pm / eval, firefox, javascript, john-resig, privacy, security

Session variables without cookies. Brilliant but terrifying hack—you can store up to 2 MB of data in window.name and it persists between multiple pages, even across domains. Doesn’t work with new tabs though, and storing JSON in it and eval()ing it is a bad idea—a malicious site could populate it before sending the user to you.

# 13th May 2008, 9:59 pm / crossdomainstorage, eval, javascript, json, security, sessions