Home/ Questions/Q 98657
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T00:14:17+00:00

While researching the issue of JSON vs XML , I came across this question

  • 0

While researching the issue of JSON vs XML, I came across this question. Now one of the reasons to prefer JSON was listed as the ease of conversion in Javascript, namely with the eval(). Now this immediately struck me as potentially problematic from a security perspective.

So I started doing some research into the security aspects of JSON and across this blog post about how JSON is not as safe as people think it is. This part stuck out:

Update: If you are doing JSON 100% properly, then you will only have objects at the top level. Arrays, Strings, Numbers, etc will all be wrapped. A JSON object will then fail to eval() because the JavaScript interpreter will think it’s looking at a block rather than an object. This goes a long way to protecting against these attacks, however it’s still best to protect your secure data with un-predictable URLs.

Ok, so that’s a good rule to start with: JSON objects at the top level should always be objects and never arrays, numbers or strings. Sounds like a good rule to me.

Is there anything else to do or avoid when it comes to JSON and AJAX related security?

The last part of the above quote mentions unpredictable URLs. Does anyone have more information on this, especially how you do it in PHP? I’m far more experienced in Java than PHP and in Java it’s easy (in that you can map a whole range of URLs to a single servlet) whereas all the PHP I’ve done have mapped a single URL to the PHP script.

Also, how exactly do you use unpredictable URLs to increase security?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. The main security hole from the blog (CSRF), is not JSON specific. It’s just as big a hole using XML instead. Indeed, it’s just as bad with no asynchronous calls at all; regular links are just as vulnerable.

    When people talk about unique URLs, they generally DON’T mean http://yourbank.com/json-api/your-name/big-long-key-unique-to-you/statement. Instead, it’s more common to make something else about the request unique; namely a value in the FORM post, or a URL parameter.

    Usually this involves a random token inserted into the FORM on the server side, and then checked when a request is made.

    The array/object thing is news to me:

    Script-Tags: The attacker can embed a script tag pointing at a remote server and the browser will effectively eval() the reply for you, however it throws away the response and since JSON is all response, you’re safe.

    In that case, your site doesn’t need to use JSON at all to be vulnerable. But yeah, if an attacker can insert random HTML into your site, you’re toast.

    • 0