Difference between “)]}',\n” and “{} &&” in avoiding json hijacking

Question

In reading about how to avoid json hijacking I\'ve come across various methods including POSTing everything or prepending responses so they are not valid JavaScript.

Answer 1

Anything that stops the JSON response being parsed as a JavaScript object or array will prevent this method of JSON Hijacking.

See this post for some methods of making your JSON secure.

However, as this answer states, it is not really an issue since Firefox 3.

Google uses an "unparseable [cruft]" to defend its self against this type of attack. It should be noted that this vulnerability has been fixed in firefox 3, and this vulnerability arises from how browsers impalement the json specification.

At the time of writing Google appear to prepend )]}' to their responses from Gmail.