A common security method to prevent JSON Injection is to prepend all JSON responses. Google uses while(1) or &&&START&&&, facebook uses for(;;);
Is it possible to prepend all JSON responses from ExpressJS?
Asked
Active
Viewed 163 times
3
Redsandro
- 10,570
- 13
- 73
- 101
rorymadden
- 924
- 2
- 10
- 19
-
1How does that work? All examples aren't proper JSON. – Redsandro Jul 25 '13 at 13:34
-
2Its a common approach to prevent JSON hijacking. http://stackoverflow.com/questions/2669690/why-does-google-prepend-while1-to-their-json-responses – rorymadden Jul 25 '13 at 16:39