Skip to content

Instantly share code, notes, and snippets.

@edinella

edinella/gist:4512106

Created January 11, 2013 16:37
Show Gist options
  • Save edinella/4512106 to your computer and use it in GitHub Desktop.
Save edinella/4512106 to your computer and use it in GitHub Desktop.
Download ZIP
A JSON Vulnerability (http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx) allows third party web-site to turn your JSON resource URL into JSONP request under some conditions. To counter this your http://expressjs.com/ server can allow only xhr requisitions with this middleware.
Raw
gistfile1.js
app.all('/path/to/api/*', function xhrOnly(req, res, next) {
if (req.xhr) next();
else res.send(403, 'XHR requests only, please');
});
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment