Bob Ippolito on JSON Hijacking

The always brilliant author of the `from future import *` blog brings us an article discussing a potential JavaScript Hijacking [pdf] scenario – the simple answer is “Don’t send JSON data as a list, send it as an object instead”. That is, if you wanted to send:

[highlight lang=js]
[“foo”, “bar”]
[/highlight]

you can avoid the security hole by sending something like this instead:

[highlight lang=js]
{“data”: [“foo”, “bar”]}
[/highlight]

and then stripping the object on the other end.