The website responds with some HTML containing some JavaScript along with a script tag. When the browser sees the script tag, it makes another GET request back to the vulnerable site to load the script, sending the auth cookie along.

Labels: javascript, json, security

I had never seen this $ref and $id tags before, so I didn’t know how to use them or what to make of it. It turns out that in order to condense the JSON object into a smaller object, it avoids rewriting an object twice if it doesn’t have to. In order to accomplish this, the JSON.NET serializer will serialize these special JSON properties of $id and $ref. Every object being serialized will get an $id. If that same exact object is used again somewhere in the same JSON object, it will use a $ref property to tell you that the particular object you’re looking at has already been serialized. It then gives you the $id to lookup as the value of the $ref property so that you know where to find the object being referred to.

Labels: c#, json, noteToSelf

If you want to bring Web API’s behavior more in line with the output of MVC’s Json() helper, you can remove XML support from your API entirely. Just add this to the Application_Start event and you’ll never see XML again...

Labels: json, microsoft, xml

Invoking web methods from client scripts is fun. But before you roll out your cool applications into the production, please don't forget to reconfigure the max JSON string length, represented by either the maxJsonLength value in the web configuration file or the MaxJsonLength property of the JavaScriptSerializer class.

Labels: .NET, ajax, json

No, as I said before the store load is _asynchronous_. Do this instead:

Code:

store.on("load", function(s,rs) {
     var myArray = new Array();
        store.each(function(record) {
        alert(record.data.ID);
        myArray.push(record.data.ID);
     });
});

Labels: ExtJS, json

* Jayrock is open-source, making it possible to extend or customize as needed.
...
* ... While ASP.NET AJAX includes some support for creating and parsing JSON text, its primary purpose is to offer a rich platform for building end-to-end Ajax-style web applications in ASP.NET. The extra bells and whistles can be distracting when your main focus is JSON.

// Due to a specification blunder in ECMAScript, typeof null is 'object',
// so watch out for that case.

Labels: json