If you don't NEED to support GET requests with JSONP / JS to be evaled, then don't. If you do need to, then the trick is to prefix what the script returns with

If you don't NEED to support GET requests with JSONP / JS to be evaled, then don't. If you do need to, then the trick is to prefix what the script returns with something that will always throw a syntax error or discontinue evaluation, the idea being that your script (same domain) can cut off the prefix and then evaluate the JS, but the attacker relying on a <script> tag cannot. for(;;); http://blackbe.lt/safely-handling-json-hijacking-prevention-methods-with-jquery/ http://blackbe.lt/safely-handling-json-hijacking-prevention-...