Why does Google prepend while(1);
to their (private) JSON responses?
For example, here\'s a response while turning a calendar on and off in Google Calen
This is to ensure some other site can't do nasty tricks to try to steal your data. For example, by replacing the array constructor, then including this JSON URL via a tag, a malicious third-party site could steal the data from the JSON response. By putting a
while(1);
at the start, the script will hang instead.
A same-site request using XHR and a separate JSON parser, on the other hand, can easily ignore the while(1);
prefix.