4 ms·
How is JSON not safe for secure data as long as its going over SSL? And as others have stated this article is 6 years old.
by systematical 14y ago
How is JSON not safe for secure data as long as its going over SSL? And as others have stated this article is 6 years old.
- jcampbell1 14y agoThis has zero to do with SSL. Let's say yourserver.com has a function like: if(user is logged in and SSL is on) emit user.credit_card_transactions as json You may think everything is okay. Now your user visits my site (With Firefox 2.0), and on my site I have: <script> // rewrite array contructor </script> <script src="https://yoursite.com/transactions.json"> Now I have effectively stolen your user's credit card transactions from your site. You see, from your server's point of view, the user is logged in and is connecting over SSL. This is mitigated by modern browsers that don't allow rewriting the array constructor. If you care about users using FF 2.0, then you need XSRF protection. Many frameworks build this in by default. XSRF can also be used for less nefarious things like: <img src="https://yourserver.com/logout https://yourserver.com/logout />
- tocomment 14y agoSo how do you prevent the logout thing?