AJAX Security Cheat Sheet § Always return JSON with an Object on the outside says:

Always have the outside primitive be an object for JSON strings:


[{"object": "inside an array"}]

Not exploitable:

{"object": "not inside an array"}

Also not exploitable:

{"result": [{"object": "inside an array"}]}

Sadly, they don't provide a rationale, at least not in the cheatsheet.

Why is that so?

As far as I'm aware, the possible attack here is Javascript array constructor poisoning, but that's been fixed for a long time already (in ES 5).

Am I missing something?


1 Answer 1


The OWASP does provide a rationale by referencing the Angular documentation on the underlying attack (which is exactly the Array constructor attack you already mentioned). There's also a slightly more detailed explanation in another part of the documentation.

Both the OWASP and Angular also explicitly point out this protection is aimed at older browsers -- or to put it more bluntly: This is for ancient versions of Internet Explorer, Firefox etc. which hopefully no user still visit websites with.

So this particular protection can probably be phased out now -- except for very special circumstances. However, it's definitely a good idea to protect sensitive JSON data as a precaution. For example, if you use session cookies to authenticate the Ajax HTTP requests, cookie prefixes and the SameSite attribute allow you to restrict the cookies to same-origin or same-site requests, so that any cross-site leak (due to future or currently unknown vulnerabilities) becomes less likely. As a nice side effect, this also works as a second layer of defense against cross-site request forgery.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .