11

Recently I read some articles about 'JSON hijacking', and some of one is here.

So, I tried to do below on my browsers, Chrome 17(dev), Firefox 8, and IE8.

  • override Object or Array constructor
  • modify __defineSetter__ method
  • modify defineProperty method

But I couldn't do anything with (literal) JSON data.

Is 'JSON hijacking' problem all solved on modern browser? Or how can I reproduce it?

Ohgyun Ahn
  • 727
  • 1
  • 9
  • 16
  • +1 Great question. FWIW, I couldn't get `Object.defineProperty()` or the overriding of `Array` to work in Chrome 16. – Matt Dec 21 '11 at 09:44
  • Read this http://stackoverflow.com/questions/2669690/why-does-google-prepend-while1-to-their-json-responses – Klemen Tusar Aug 29 '14 at 12:13

2 Answers2

2

It's not about the legitimate application parsing the JSON - JSON hijacking is an information disclosure issue about some malicious party requesting your JSON data instead of the real application while the user is logged into the application that uses the api usually. Simple authentication does not help - as the browser sends the auth information e.g. auth-cookie for free :-/.

But with ES5 most current browser won't be affected anymore directly by this issue. Nonetheless, in depth defense rules! And may protect against future issues too or regressions and etc.

lao
  • 1,437
  • 18
  • 22
dalini
  • 176
  • 1
  • 9
0

Something like that could in theory be abused if you use eval to decode JSON.

Popular JS libraries which provide JSON decoding functionality will default to JSON.parse when the browser has builtin JSON support, thus any recent browser shouldn't be vulnerable unless your code is incorrectly written.

Jani Hartikainen
  • 40,227
  • 10
  • 60
  • 82
  • 1
    Decoding is not really relevant as a remote domain could not read the response anyway due to the [Same Origin Policy](http://en.wikipedia.org/wiki/Same-origin_policy). – SilverlightFox Jan 08 '14 at 09:46
  • 2
    The whole point is that the Same Origin Policy does not apply to script tags. –  Aug 29 '14 at 12:34