Search code examples
securityjsoncsrf

CSRF: can the JSON data returned by a POST request be stolen?

Can the JSON data, returned by a POST request be stolen by a cross-site request forgery attack?

Solution

  • It cannot be done using JS, but I'm not sure about Flash's cross-domain request.

    In JS POST request can be made via forms and XMLHTTPRequest. You can't see result of a cross-domain form, so that's safe. XHR forbids cross-domain requests, so that's safe too.

    Browsers do allow cross-domain inclusion of scripts via <script> element, but that is using GET only.