JSON (JavaScript Object Notation) is an open standard for formatting text to transmit data objects.

learn more… | top users | synonyms

2
votes
1answer
146 views

XSS not exploitable when POST data is sent in JSON?

There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the ...
1
vote
1answer
93 views

How does JTI prevent a JWT from being replayed?

According the JWT RFC a JWT token can optionally have a jti which I interpret to be an a unique ID for a JWT Token. Seems like a UUID is a good value for a jti. The RFC claims that the jti can be used ...
0
votes
1answer
34 views

How to securely insert JSON objects into javascript, DOM content and html elements attributes?

Is there a way to sanitize or scape strings to secure put data in a object into script or DOM like: var myObj = JSON.parse({someObject: value}) someElement.innerHTML('<div data-id="'+myObj....
1
vote
0answers
418 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
0
votes
0answers
106 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...