KludgeHack

Safe JSON

There are two famous problems with JSON security. The first is CSRF (Cross Site Request Forgery) which is known as one click attack and allows the attacker to bypass cookie based authentication. The second, and lest known, is the JSON/Array hack that allows a user to steal JSON data on any other platform with a modern JavaScript interpreter.

Jeremiah Grossman used CSRF to break GMail over a year ago.

Joe Walker’s writes in his blog about the problems with JSON and secured data, specially the JSON/Array hack.