Home/ Questions/Q 8043955
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-05T05:04:33+00:00

I was looking at some facebook XHR request. I seen that there is a

  • 0

I was looking at some facebook XHR request. I seen that there is a request that is cross domain, and the response is a JSON like:

for (;;); {/* JSON object */}

Why that response starts with a for???
I think it is related to some security reason, can someone explain me it?
Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This is done to protect against XSS.

    If a malicious site includes that JSON URL in a <script> tag, the browser will freeze.
    The actual client site can just strip the prefix; other sites cannot, because of the Same-Origin Policy.

    • 0