Why does Google prepend while(1); to their JSON responses?
stackoverflow.com
Why does Google prepend while(1); to their JSON responses?
1–10 of 120 posts
Re: Why does Google prepend while(1); to their JSON responses?
#2[deleted]
Re: Why does Google prepend while(1); to their JSON responses?
#3Why don't browsers strip cookies when they are doing cross domain javascript fetches?
Re: Why does Google prepend while(1); to their JSON responses?
#4Why don't browsers strip cookies when they are doing cross domain javascript fetches?
I'd say it's because of advertising mostly, but a lot of similar tech (that is usually ad supported) like Disqus.
It's interesting that today cross-domain sandboxing applies to almost everything except JavaScript. If I load an image cross domain and draw it into a canvas, the contents of that canvas are sandboxes, but I can cheerfully mix and match code across domains too.
Seems like it would be a good thing to do but it would break a ton of stuff.
Re: Why does Google prepend while(1); to their JSON responses?
#5Why don't browsers strip cookies when they are doing cross domain javascript fetches?
Because that's the way internet works and breaking it means breaking a lot of websites. Web security wasn't thought carefully when web was built, it's just a bunch of dirty hacks around most obvious vulnerabilities.
Re: Why does Google prepend while(1); to their JSON responses?
#6I haven't worked with JSON like that before. Do JSON parsers properly ignore the stuff Google puts in, or do you have to strip it out before parsing?
Re: Why does Google prepend while(1); to their JSON responses?
#7Why don't browsers strip cookies when they are doing cross domain javascript fetches?
Can I turn this off?
Re: Why does Google prepend while(1); to their JSON responses?
#8I haven't worked with JSON like that before. Do JSON parsers properly ignore the stuff Google puts in, or do you have to strip it out before parsing?
In the very first stack overflow answer:
> an AJAX request at mail.google.com
> will have full access to the text content,
> and can strip it away.Re: Why does Google prepend while(1); to their JSON responses?
#9Why don't browsers strip cookies when they are doing cross domain javascript fetches?
Isn't that what Safari does with the "Allow from current website only" setting? It defaults to "Allow from websites I visit", which means that only embedded content from sites you've visited before get their cookies, not random new embeds)
Re: Why does Google prepend while(1); to their JSON responses?
#10That is one weird array in Google's reply. Looks like it could have been an object instead, whereby JSON hijacking wouldn't be a problem.