title: Is JSON Hijacking still an issue in modern browsers?
body: <p>I am using Backbone.js and the Tornado web server.  The standard behavior for receiving collection data in Backbone is to send as a JSON Array.</p>
  
  <p>On the other hand, Tornado's standard behavior is to not allow JSON Array's due to the following vulnerability:</p>
  
  <p><a href="http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx" rel="noreferrer">http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx</a></p>
  
  <p>A related one is:
  <a href="http://haacked.com/archive/2009/06/25/json-hijacking.aspx" rel="noreferrer">http://haacked.com/archive/2009/06/25/json-hijacking.aspx</a></p>
  
  <p>It feels more natural for me to not have to wrap up my JSON in an object when it really is a list of objects.</p>
  
  <p>I was unable to reproduce these attacks in modern browsers (i.e. current Chrome, Firefox, Safari, and IE9).  At the same time I was unable to confirm anywhere that modern browsers had addressed these issues.</p>
  
  <p>To ensure that I am mislead neither by any possible poor programming-skills nor poor googling-skills:</p>
  
  <p><strong>Are these JSON Hijacking attacks still an issue today in modern browsers?</strong></p>
  
  <p>(Note:  Sorry for the possible duplicate to: <a href="https://stackoverflow.com/questions/8587567/is-it-possible-to-do-json-hijacking-on-modern-browser">Is it possible to do &#39;JSON hijacking&#39; on modern browser?</a>  but since the accepted answer does not seem to answer the question - I thought it was time to ask it again and get some clearer explanations.)</p>