title: Javascript hijacking, when and how much should I worry?
body: <p>Ok, so I'm developing a web app that has begun to be more ajaxified. I then read a blog that talked about <a href="http://jeremiahgrossman.blogspot.com/2007/04/javascript-hijacking.html" rel="nofollow">javascript hijacking</a>, and I'm a little confused about when it's actually a problem. I want some clarification</p>
  
  <p><strong>Question 1:</strong>
  Is this the problem/vulnerability?</p>
  
  <blockquote>
    <p>If my site returns json data with a 'GET' request that has sensitive
    information then that information can get into the wrong hands.</p>
  </blockquote>
  
  <p>I use ASP.NET MVC and the method that returns JSON requires you to explicitly allow json get requests. I'm guessing that they are trying to save the uninitiated from this security vulnerability.</p>
  
  <p><strong>Question 2:</strong>
  Does the hijacking occur by sniffing/reading the response as it's being sent through the internet? Does SSL mitigate that attack?</p>
  
  <p><strong>Question 3:</strong>
  This led me to ask this question to myself. If I'm storing page state in local javascript object(s) of the page, can someone hijack that data(other than the logged in user)?</p>
  
  <p><strong>Question 4:</strong>
  Can I safely mitigate against <strong>THIS</strong> vulnerability by only returning JSON with a 'POST' request? </p>