JSON over HTTP Transport

[mitsuhiko]

The current spec has this in it:

XSSI attacks could potentially make source maps available to attackers by doing a direct script src to a source map after overriding the Array constructor. This can be effectively prevented by preprending a JavaScript syntax error to the start of the response.

Thus when delivering source maps over HTTP, servers may prepend a line starting with the string “)]}'” to the sourcemap. If the response starts with this string clients must ignore the first line.

Does this still carry relevancy in the current day and age and is this consistently being implemented? I haven't seen source maps actually being prefixed with that character sequence.

[littledan]

Rob, Justin and Jaro report that this is common enough that we can't remove it.

[mitsuhiko]

This is resolved now. A note has been added to the spec as discussed.