Why is there a for(;;); preamble in facebooks JSON responses?

javascript, json

Solution

See this StackOverflow post: How to restrict JSON access?

In particular this comment within that thread: for/while loops in JSON responses

Basically this is used so that attackers can't get the URL and include it on their page and have JavaScript now put the variables on the page because as soon as the request has been serviced the browser will go into an infinite loop not allowing other JavaScrip access to said variables which would potentially allow attackers to use your browser to get information that is meant to stay private.

Problem

Original source

Related problems

• Why does Google prepend while(1); to their JSON responses?
• How do I restrict JSON access?
• Why does Google prepend while(1); to their JSON responses?