Simon Willison’s Weblog

What are the JSON security concerns in web development?

6th January 2011

My answer to What are the JSON security concerns in web development? on Quora

Be very careful when implementing JSON-P for authenticated actions—evil third party sites could assemble URLs to your user’s private data and steal it. This attack has worked against Gmail in the past.

A few years ago there was a security issue where Mozilla browsers could be tricked in to leaking JSON arrays even if they weren’t wrapped in JSON-P—this has since been fixed, but it’s still a good idea to wrap your private JSON response in a JS comment and have your Ajax calling code remove those comments before eval()ing the JSON. This prevents external sites from taking advantage of newly discovered JSON execution vulnerabilities like the old Mozilla one.

If you are consuming JSON-P from another site, be VERY sure you can trust that site in the future, since you’re opening yourself up to a nasty XSS attack if they go rogue. Ideally you should be monitoring them to check if they suddenly turn evil one day (or their domain name gets hijacked).

Basically, make sure you have a deep understanding of the same-origin policy, JSON-P and XSS and you should be fine.