A common security method to prevent JSON Injection is to prepend all JSON responses. Google uses while(1) or &&&START&&&, facebook uses for(;;);
Is it possible to prepend all JSON responses from ExpressJS?
Asked
Active
Viewed 161 times
3
Redsandro
- 10,080
- 11
- 64
- 94
rorymadden
- 904
- 2
- 10
- 19
-
1How does that work? All examples aren't proper JSON. – Redsandro Jul 25 '13 at 13:34
-
2Its a common approach to prevent JSON hijacking. http://stackoverflow.com/questions/2669690/why-does-google-prepend-while1-to-their-json-responses – rorymadden Jul 25 '13 at 16:39