Simon Willison’s Weblog

Don't serve JSON as text/html. Another sneaky XSS trick.

Posted 5th July 2006 at 11:46 pm

Recent articles

Adding dynamic features to an aggressively cached website - 28th January 2026
ChatGPT Containers can now run bash, pip/npm install packages, and download files - 26th January 2026
Wilson Lin on FastRender: a browser built by thousands of parallel agents - 23rd January 2026

http 100 json 144 security 573 xss 60

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe