Intermediate LevelAuthentication & Authorization
What is Cross-Site Script Inclusion (XSSI) and how do JSON prefixes prevent payload leaks?
❓ Interview Prompt: Explain Cross-Site Script Inclusion (XSSI), dynamic JSON script tag execution, and non-executable JSON prefixes.
Cross-Site Script Inclusion (XSSI) is a vulnerability where an attacker's website includes an authenticated API endpoint returning JSON data using a standard HTML '<script src="https://victim.com/api/user.json">' tag.
How Non-Executable JSON Prefixes Stop XSSI:
Google and Angular endpoints prepend a non-executable prefix (such as ')]}',\n' or 'for(;;);') to JSON responses:
'''json
)]}',
{ "email": "alice@company.com", "balance": 500 }
'''
•
If an attacker attempts to load the endpoint via a '<script>' tag, the browser tries to execute ')]}',' as JavaScript code, throwing an instant syntax error and crashing execution!
•
Legitimate AJAX calls strip the prefix before parsing JSON cleanly via 'JSON.parse()'.
Code Implementation Example
typescript
// Express response interceptor attaching XSSI non-executable prefix
app.get('/api/user/profile', (req, res) => {
const userData = { id: 'usr_1042', email: 'user@company.com' };
// Prepend non-executable prefix to JSON string
res.setHeader('Content-Type', 'application/json');
res.send(")]}',\n" + JSON.stringify(userData));
});💡Prepending XSSI non-executable prefix to dynamic JSON API responses.
🎯 Interview Key Takeaway
XSSI non-executable prefixes ()]}',\n) cause malicious script tags to throw syntax errors while allowing valid AJAX JSON parsing.
#XSSI#JSON Security#Prefix#API Security#Intermediate
Back to all Authentication & Authorization Questions→