JavaScript

Entries from November 2008

Tuesday, November 4. 2008

Bob Ippolito on JSON Hijacking

The always brilliant author of the `from future import *` blog brings us an article discussing a potential JavaScript Hijacking [pdf] scenario – the simple answer is “Don’t send JSON data as a list, send it as an object instead”. That is, if you wanted to send:

["foo", "bar"]

you can avoid the security hole by sending something like this instead:

{"data": ["foo", "bar"]}

and then stripping the object on the other end.

Posted by TML in JavaScript at 13:14 | Comments (0) | Trackbacks (0)

(Page 1 of 1, totaling 1 entries)

Calendar

Quicksearch

Archives

Syndicate This Blog

Blog Administration

Open login screen

Powered by

Serendipity PHP Weblog

Template dropdown

Statistics

Last entry: 2011-09-01 12:27

101 entries written

51 comments have been made

Statistics

Last entry: 2011-09-01 12:27

101 entries written

51 comments have been made

Statistics

Last entry: 2011-09-01 12:27

101 entries written

51 comments have been made