I Love Lamp wrote:

JSON Hijacking

It appears that there is quite a bit of misinformation out there regarding JSON (JavaScript) Hijacking. This site contains the orignial white paper that was put together by Fortify Software.


It seems that the main problems are servers willing to send JSON data to a session authenticated user via HTTP GET method.


Even though it requires that the JSON data objects are sent back in Arrays ([]), this may be a true concern for people that are storing sensative information in their JSON data.

All your webapps are belong to Billy.

RE: Schneier on Security: JavaScript Hijacking