-
Notifications
You must be signed in to change notification settings - Fork 46
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Should support returning a prefix to avoid JSON hijacking on GET requests. #14
Comments
Can you explain what you mean by this @JulianBirch ? |
See JSON hijacking for a detailed explanation of this attack. The author of this issue is proposing that we add an configurable prefix so a user can add something like |
Exactly. On a related note, it's worth considering whether secure should be the default. I've got the same problem with cljs-ajax: secure by default is a good idea, but it would be a horribly breaking change. |
Adding a prefix is only necessary if the endpoint is using cookies for verification and returns an array. For standalone APIs or AJAX interfaces that use tokens, or for endpoints that return anything but an array, a prefix is unnecessary and something of a hindrance. |
No description provided.
The text was updated successfully, but these errors were encountered: