What are the JSON security concerns in web development?
My answer to What are the JSON security concerns in web development? on Quora
Be very careful when implementing JSON-P for authenticated actions—evil third party sites could assemble URLs to your user’s private data and steal it. This attack has worked against Gmail in the past.
A few years ago there was a security issue where Mozilla browsers could be tricked in to leaking JSON arrays even if they weren’t wrapped in JSON-P—this has since been fixed, but it’s still a good idea to wrap your private JSON response in a JS comment and have your Ajax calling code remove those comments before eval()ing the JSON. This prevents external sites from taking advantage of newly discovered JSON execution vulnerabilities like the old Mozilla one.
If you are consuming JSON-P from another site, be VERY sure you can trust that site in the future, since you’re opening yourself up to a nasty XSS attack if they go rogue. Ideally you should be monitoring them to check if they suddenly turn evil one day (or their domain name gets hijacked).
Basically, make sure you have a deep understanding of the same-origin policy, JSON-P and XSS and you should be fine.
More recent articles
- ChatGPT should include inline tips - 30th May 2023
- Lawyer cites fake cases invented by ChatGPT, judge is not amused - 27th May 2023
- llm, ttok and strip-tags - CLI tools for working with ChatGPT and other LLMs - 18th May 2023
- Delimiters won't save you from prompt injection - 11th May 2023
- Weeknotes: sqlite-utils 3.31, download-esm, Python in a sandbox - 10th May 2023
- Leaked Google document: "We Have No Moat, And Neither Does OpenAI" - 4th May 2023
- Midjourney 5.1 - 4th May 2023
- Prompt injection explained, with video, slides, and a transcript - 2nd May 2023
- download-esm: a tool for downloading ECMAScript modules - 2nd May 2023
- Let's be bear or bunny - 1st May 2023