Simon Willison’s Weblog

Don't serve JSON as text/html. Another sneaky XSS trick.

Posted 5th July 2006 at 11:46 pm