A common security method to prevent JSON Injection is to prepend all JSON responses. Google uses while(1) or &&&START&&&, facebook uses for(;;);
Is it possible to prepend all JSON responses from ExpressJS?
Asked
Active
Viewed 165 times
3
Redsandro
- 11,060
- 13
- 76
- 106
rorymadden
- 954
- 3
- 10
- 20
-
1How does that work? All examples aren't proper JSON. – Redsandro Jul 25 '13 at 13:34
-
2Its a common approach to prevent JSON hijacking. http://stackoverflow.com/questions/2669690/why-does-google-prepend-while1-to-their-json-responses – rorymadden Jul 25 '13 at 16:39