Why does Google prepend while(1); to their JSON responses?

Re:Why does Google prepend while(1); to their JSON responses? by Stealth- on Sunday December 29, 2013 @11:34PM (#6983053)

I imagine it assumes a header like X-Requested-By has not been manipulated. You can safely assume that the referrer, or other headers, have not been manipulated. There is no way for malicious Javascript running in the users browser to edit headers.

Of course, anyone can code their own browser to lie about headers. It doesn't make much sense to specifically open yourself to vulnerabilities though.

[ Parent | on HN ]

Re:Why does Google prepend while(1); to their JSON responses? by homakov on Sunday December 29, 2013 @11:39PM (#6983065)

exactly. since normal script-tag cannot drop new X-Requested-With header, there's no need to add some "while(1)" things which look ugly.

There's downside, though - you can't inspect JSONs by simply opening them in a new tab.

[ Parent | on HN ]