It prevents the response from being evaluated as Javascript. In some older web browsers (like Firefox 2.0), this was required to prevent an attack where the Ar

It prevents the response from being evaluated as Javascript. In some older web browsers (like Firefox 2.0), this was required to prevent an attack where the Array constructor is overridden to capture arrays within a response. This no longer works on any modern browser, but a lot of web services still attempt to defend against it. https://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx/ https://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-j...