Should support returning a prefix to avoid JSON hijacking on GET requests.

[JulianBirch]

[dyba]

Can you explain what you mean by this @JulianBirch ?

[weavejester]

See JSON hijacking for a detailed explanation of this attack.

The author of this issue is proposing that we add an configurable prefix so a user can add something like while(1); to the beginning of their JSON.

[JulianBirch]

Exactly. On a related note, it's worth considering whether secure should be the default. I've got the same problem with cljs-ajax: secure by default is a good idea, but it would be a horribly breaking change.

[weavejester]

Adding a prefix is only necessary if the endpoint is using cookies for verification and returns an array. For standalone APIs or AJAX interfaces that use tokens, or for endpoints that return anything but an array, a prefix is unnecessary and something of a hindrance.