Why does Google append while(1); in front of their JSON responses?

Re:Why does Google append while(1); in front of their JSON r... by nodesocket on Tuesday February 05, 2013 @03:24AM (#5169725)

This doesn't protect again using an <img> tag to accomplish the same thing correct? Assume a malicious user wanted to delete something and the URI was formatted like: http://mydomain.com/delete/some-id-here. Then assuming the user is logged in, a simple <img src="http://www.mydomain.com/delete/some-id-here /> on a third party site would execute the request successfully correct?

[ Parent | on HN ]

Re:Why does Google append while(1); in front of their JSON r... by hendi_ on Tuesday February 05, 2013 @03:37AM (#5169758)

Yes. This is why you never perform any actions which change something over GET. Use POST (or PUT or DELETE) for them.

[ Parent | on HN ]

Re:Why does Google append while(1); in front of their JSON r... by nostrademons on Tuesday February 05, 2013 @04:29AM (#5169883)

This is one of the reasons why you never perform any actions which change something over GET. The main reason is so your site doesn't get deleted when the Googlebot visits. (Or more generally, so that web crawlers and other robots don't accidentally mutate the site.)

Using POST is not sufficient; you also need to include an XSRF token that only the requesting page knows. It's very possible to send a POST to a third-party site with about one line of Javascript. (In the relatively early days of Reddit, I wrote a page that upvoted itself by having a JS handler in an invisible iframe resubmit the same link over again, using the visitor's login credentials. At the time, submitting the same link twice on Reddit counted as an upvote, and so merely visiting the page would upvote the link.)

[ Parent | on HN ]

Re:Why does Google append while(1); in front of their JSON r... by hendi_ on Tuesday February 05, 2013 @05:06AM (#5169964)

You're right, I only focused on that one single reason for my post since I was in a hurry.

Security issues are obviously more complex than one-line explanations. Thank you for your more elaborate reply!

[ Parent | on HN ]

Re:Why does Google append while(1); in front of their JSON r... by rmc on Tuesday February 05, 2013 @04:32AM (#5169892)

Yes, that solves that. But you should use CSRF. Otherwise someone could have a <form method=POST action="http://mysite.example.com/delete>…</form>; on their site and a javascript that will submit the form upon page load.

[ Parent | on HN ]

Re:Why does Google append while(1); in front of their JSON r... by fhars on Tuesday February 05, 2013 @03:38AM (#5169760)

If that works then the developer responsible for mydomain.com should be reprimanded for wilful incompetence. And that isn't even the problem the while(1); trick is meant to mitigate.

[ Parent | on HN ]

Re:Why does Google append while(1); in front of their JSON r... by brown9-2 on Tuesday February 05, 2013 @10:13AM (#5171010)

The scenario you mentioned is one of the things people mean when they talk about cross-site request forgery.

[ Parent | on HN ]