The json tag has no wiki summary.
11
votes
3answers
2k views
How should web app developers defend against JSON hijacking?
What is the best defense against JSON hijacking?
Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested:
If the ...
7
votes
2answers
1k views
CSRF With JSON POST
I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
7
votes
2answers
302 views
Security risks with JSONP?
What are the security risks with JSONP? Is using JSONP in a new web application reasonable, from a security perspective, or is it better to use a different method for cross-origin web mashups?
If ...
3
votes
4answers
750 views
XSS : Content-type: application/json
Background information
- Application responds to request to a particular URL with content-type: application/json
JSON response contains a parameter from the request
Escapes the quote with a slash
...
3
votes
2answers
758 views
How can I prevent reflected XSS in my JSON web services?
I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response.
This is open to XSS if the response is rendered as HTML by the browser since someone ...
2
votes
2answers
308 views
Is XSS possible here? Challenge
Is possible to bypass my regex and execute any javascript?
<script>
function json(a){
if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
2
votes
2answers
2k views
Is this JSON encoding vulnerable to CDATA injection?
I ran across an odd notation in the jsfiddle.net generated pages
<script type='text/javascript'>//<
2
votes
2answers
326 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
