JSON hijacking (sometimes called Javascript hijacking[15]) is an attack based on CSRF techniques. This attack uses the fact that JSON is a subset of JavaScript, so, if a service returns JSON strings as response, it is possible to assign this string to an object and to use this object from a third party page (the source page for the CSRF) to stole informations.

If a service returns a JSON object, this object is described the same as a Javascript object, and so, it is included in the page environment. If the attacker override the javascript's object constructor function, he can stole the informations included into the object.

This attack was used in the past to show a Gmail vulnerability, more detailed informations are in [17].

SOLUTION: because the attack is based on CSRF, avoiding CSRF corresponds to avoid JSON hijacking.

Anyway, including the JSON response into javascript code that makes the returned string unreadable if not elaborated is another way. For example, including the JSON response into “/* */”, that are comments symbols for JavaScript. The attacker's page, using CSRF, can't' modify the strings, and so, because this string for javaScript is comment, it is ignored and the data inside it can't be read by the attacker's code.