CSRF is different from JSON hijacking, but they're closely related. This only prevents attacks that uses a script to execute a get method and returns a JSON ar

CSRF is different from JSON hijacking, but they're closely related. This only prevents attacks that uses a script to execute a get method and returns a JSON array. JSON arrays can be "executed" as if it was javascript. The attack relies on modifying what javascipt does when this faux script is ran. So if you put a "while(1);" in there, it prevents it from finishing. Thus preventing the exposure of the sensitive data. It's similar to CSRF since that attack relies on the user to have an active session to be able to access sensitive data, but they differ in MO.