3 ms·

Note that these protections are only needed because Google supports every imaginable browser version even outdated ones. You most certainly do not need to do th

by hdhzy 9y ago

Note that these protections are only needed because Google supports every imaginable browser version even outdated ones. You most certainly do not need to do the same. Array and object globals cannot be overridden now (since 2007) for literals [0] and for ambient authority problem with CORS just check the Origin header. [0]: https://johnresig.com/blog/re-securing-json/ https://johnresig.com/blog/re-securing-json/

emmelaich 9y ago
That would a good note to add to that StackOverflow question.
fixermark 9y ago
> You most certainly do not need to do the same. ... except that those browsers are still out there, so it depends heavily on how much damage someone can do by abusing the data your server can emit whether you need to do the same.
- deleted 9y ago
  [deleted]
- sagethesagesage 9y ago
  It's more that people who use those browsers are being protected. It's not that those browsers can poke security holes in the site, they're just vulnerable to losing their own data.
- amenghra 9y ago
  If you are browsing the web with a 10 year old browser you are opening yourself up to a ton of security bugs. Whether json responses contain a while loop or not isn't going to make a difference. The reason Google and Facebook keep this kind of stuff around is because it's there and doesn't hurt to keep it. There's a slight chance it will provide some protection if a similar attack vector is discovered.
  - Roodgorf 9y ago
    But aren't you saying this is an already existing attack vector then?? Why try to find a similar one if you knew you could just get an older browser version and use this one? Is that not a good enough reason to be prepared for it?
    - hcs 9y ago
      As sagethesagesage said [1], you're protecting the user from having their browser pass the user's data from your site to a malicious site. The attacker shouldn't be able to make the user run an old, vulnerable browser. [1] https://news.ycombinator.com/item?id=14282532 https://news.ycombinator.com/item?id=14282532

by hdhzy 9y ago

emmelaich 9y ago

That would a good note to add to that StackOverflow question.

fixermark 9y ago

> You most certainly do not need to do the same. ... except that those browsers are still out there, so it depends heavily on how much damage someone can do by abusing the data your server can emit whether you need to do the same.

deleted 9y ago
[deleted]
sagethesagesage 9y ago
It's more that people who use those browsers are being protected. It's not that those browsers can poke security holes in the site, they're just vulnerable to losing their own data.
amenghra 9y ago
If you are browsing the web with a 10 year old browser you are opening yourself up to a ton of security bugs. Whether json responses contain a while loop or not isn't going to make a difference. The reason Google and Facebook keep this kind of stuff around is because it's there and doesn't hurt to keep it. There's a slight chance it will provide some protection if a similar attack vector is discovered.
- Roodgorf 9y ago
  But aren't you saying this is an already existing attack vector then?? Why try to find a similar one if you knew you could just get an older browser version and use this one? Is that not a good enough reason to be prepared for it?
  - hcs 9y ago
    As sagethesagesage said [1], you're protecting the user from having their browser pass the user's data from your site to a malicious site. The attacker shouldn't be able to make the user run an old, vulnerable browser. [1] https://news.ycombinator.com/item?id=14282532 https://news.ycombinator.com/item?id=14282532