Search code examples
wcfjsonxsssecuritycsrf

Is WCF result as JSON + unparseable curft needed for better security? How is it implemented?

I'm reading about this ajax response that describes ways to prevent Javascript based exploits.

  1. Does it make sense to apply this technique to WCF-based services that return JSON?

  2. How would this be implemented server side?

  3. How would the client consume it?

Solution

  • There's one way WebScriptEnablingBehavior -- the behavior of choice if you want a WCF service that works with ASP .NET AJAX -- deals with this. By default, its response mode is "WrappedResponse". If you watch this in action using Fiddler, it means that every response from the service -- even a simple number -- will wrapped in {d:} wrapper as follows:

     { "d" : return-value }

    On the other hand, WebHttpBehavior is XML out-of-the-box, but if you switch it to JSON, you can choose between WrappedResponse and BareResponse. WrappedResponse is similar to WebScriptEnablingBehavior (if I remember correctly), but BareResponse would be unsecure JSON transmitted back as a direct return value.