I agree that eval() is evil and JSON.parse() is the way to go. However, in this particular case this doesn't matter much, because the site itself controls wher

I agree that eval() is evil and JSON.parse() is the way to go. However, in this particular case this doesn't matter much, because the site itself controls where to load the JSON from. Manipulating the JSON response requires access to the webserver or the DNS, and in those cases the attacker could have manipulated the initial HTML response as well. > By eval()ing your json you are doing most of the attackers work for them. All that stuff in the article about mime types is redundant if you're eval()ing your json. This totally misses the context of the article. The article is about CSRF. That is, the _attacker_ downloads and executes the JSON. This is _not_ about downloading the attacker's JSON! It is about how to construct the JSON in a way that it is unaccessible through a <script> tag from the attacker's site.