While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source:

To prevent against Cross Site Script Inclusion (XSSI) attacks, the JSON response body starts with a magic prefix line that must be stripped before feeding the rest of the response body to a JSON parser:

[ ... valid JSON ... ]

How does prefixing the response body with seemingly random characters work to prevent XSSI?


XSSI works by trying to evaluate a JSON response as Javascript and the sequence )]}' prevents this by reliably producing a syntax error.

There have been different proposed countermeasures against unwanted script inclusion, but putting an infinite loop (I have seen for(;;) used in Facebook APIs) or producing a syntax error (some Google APIs use )]}' as in your example) has shown to be sufficiently sound and is backward compatible. This article has some additional examples.

If you're unsure about why XSSI is a threat in the first place and violates the same-origin policy, read about it here.

  • '...evaluate your JSON response as Javascript' Is that common? It seems like a really unsafe practice.
    – ecnepsnai
    Jan 14 '16 at 17:27
  • @ecnepsnai It's a concept to overcome cross-origin restrictions and the core idea of JSONP. en.wikipedia.org/wiki/JSONP
    – Arminius
    Jan 14 '16 at 17:53
  • LOL -- "The browser's security mechanisms won't let me load this JSON data from a foreign source. I know! Embed the data inside javascript and eval() it!". That sounds like a terrible idea.... Aug 14 '19 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.