KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
I recently started looking into building web applications using .NET MVC and I stumbled upon this blog post by Phil Haack: JSON Hijacking . For those of you who aren't aware of this vulnerability when using JSON to transfer sensitive data it's really a must read. It seems that there are three ways to handle this vulnerability. Require a POST instead of GET in your JSON service. Wrap your JSON array responses in a JSON object. Don't expose sensitive data in any service that isn't protected by 1 or 2. The third alternative isn't really an option since it really limits the use of JSON. So which one of the other two do you prefer? The .NET MVC 2 preview requires a POST for JSON responses by default, I think this is a great way to protect any developer that doesn't know about this problem yet. But to me it feels a little "hacky" to break REST in this way. Unless someone talks me out of it I'm sticking to wrapping my arrays in another object and unwrapping it client side.
Tags (comma-separated)
Save Edits
Cancel