javascript - 向 ASP.NET MVC JsonResult 添加无法解析的内容

Question

鉴于这些帖子:

JSON unparseable cruft: Why so serious?

Why do people put code like "throw 1; <dont be evil>" and "for(;;);" in front of json responses?

Why does Google prepend while(1); to their JSON responses?

我想遵循以下答案中的建议:How should web app developers defend against JSON hijacking?

有没有一种简单的方法可以向使用 System.Web.Mvc.JsonResult 构建的 JSON 响应添加无法解析的内容？ ？ security.se帖子建议我使用 </*在响应的开头。

Answer 1

您可以编写自定义操作结果来执行此操作:

public class SafeJsonResult: JsonResult
{
    public override void ExecuteResult(ControllerContext context)
    {
        context.HttpContext.Response.Write("</*");
        base.ExecuteResult(context);
    }
}

然后使用它代替默认的:

public ActionResult Index()
{
    return new SafeJsonResult
    {
        Data = new { Foo = "bar" },
        JsonRequestBehavior = JsonRequestBehavior.AllowGet,
    };
}