Geek Answers Handbook

Is this really a JSON response?

Guru Guru

I call the corporate application's REST APIs that remain nameless and they return JSON, for example the following:

throw 'allowIllegalResourceCall is false.';
{
  "data": ... loads of valid JSON stuff here ...
}

Is this really JSON? If (as I suspect) this is not the case, are there any good reasons for these types of fraud?

The answer I received from the application provider is that this is done for security purposes, but I'm struggling to figure out how this improves security, if at all.

Thanks in advance!

Peter

+5
source share
6 answers

According to

http://jsonlint.com/

This is not true.

Something like below.

{
    "data": "test"
}

Do you expect to pull JSon load from the message above?

+5
source

JSON. , , , JIVE:). JIVE api. V3 API. , . ( , JIVE )

//invalid jason response... https://developers.jivesoftware.com/community/thread/2153  
 jiveResponse = jiveResponse.Replace
 ("throw 'allowIllegalResourceCall is false.';",String.Empty);
+3

: CSRF. URL- JSON <script>, . , URL- JSON API, .

, Object.prototype / Array.prototype, , ( JSON javascript). throw , javascript, , <script>.

+1

JSON. , , - ?

. , .

0

throw 'allowIllegalResourceCall is false.';, , JSON.

MIME ?

0

, , JSON Hijacking. JSON Hijacking , JSON. , , JSON .

, , JSON.

0

More articles:


All Articles