title: JSON hijack injection - best practices for avoidance - & which browsers are vulnerable?
body: <p>What are the best methods to securing a json response?</p>
  
  <p>We do address verification that is a response back from a web service in json format. We would like to secure that response.</p>
  
  <p>There are a few mentions, using a "while(1)" to cause an infinite loop and I'm curious to know of other tried and true methods.</p>
  
  <p>Based on:
  <a href="http://lab.gsi.dit.upm.es/semanticwiki/index.php/JSON_Hijacking_%28aka_JavaScript_Hijacking%29" rel="nofollow">http://lab.gsi.dit.upm.es/semanticwiki/index.php/JSON_Hijacking_%28aka_JavaScript_Hijacking%29</a></p>
  
  <p><a href="http://capec.mitre.org/data/definitions/111.html" rel="nofollow">http://capec.mitre.org/data/definitions/111.html</a></p>
  
  <p><em><strong>UPDATE</em></strong></p>
  
  <p>Ok, a more specific question may be which browsers are vulnerable to this type of injection?</p>
  
  <p>and is returning json over ssl and making sure it's correct syntax (not just an array) enough of a security safeguard?</p>