There's no need to change JSON. This is a non-issue if you adhere to a few basic security practices: 1. Use crumbs to protect against XSRF. 2. Responses that

There's no need to change JSON. This is a non-issue if you adhere to a few basic security practices: 1. Use crumbs to protect against XSRF. 2. Responses that should not be cached by proxies should have a "Cache-Control: private" header. The "what if there's a broken proxy" argument in the post is specious, since a proxy that's broken in this way will cause much more serious security problems than are being discussed here (e.g. John visits google.com and gets Jane's cached Google homepage from the proxy). 3. Responses that should not be cached by browsers or proxies should have a "Cache-Control: no-cache" or "Cache-Control: no-store" header. 4. If you're still concerned, wrap your JSON responses in objects yourself; there's no need to modify the format to do it for you.