Why does Google prepend while(1); to their JSON responses?
I think it's important to note that this is a bug that effects older browsers only. Modern IE, Chrome, and Firefox have security measures that do not allow scripts to capture values passed to constructors of a literal. That way, this hack is only needed for older browsers and will hopefully not be needed at all in the future. For more info: <a href="http://stackoverflow.com/a/16880162/372767" rel="nofollow">http://stackoverflow.com/a/16880162/372767</a><p>Also note that this attack, JSON Hijacking, is <i>different</i> than a CSRF (Cross Site Request Forgery) and has little to do with CSRF tokens.