Re: [whatwg/fetch] json() function does not support anti-json hijacking techniques (#321)

@annevk , as it also mentioned in comments to the SO answer @duanyao provided, one can not rely on users having modern browser in a question regarding security. From cainuse.com, only Android 4.4 implements full ES5, which ensured invulnerability to this kind of attack. Status of 4.3- is unclear, and it comprises almost 20% of active Android devices, which would comprise 3%+ of all browser users ( see https://en.wikipedia.org/wiki/Usage_share_of_web_browsers#Crossover_to_mobile_getting_more_popular and https://developer.android.com/about/dashboards/index.html ).

Essentially, anyone, who cares about not leaking information via hijacking, must take into account, that at least 3% of users require that protection. I'd expect essentially every major web site, and every enterprise continue using this particular technique to mitigate it.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/issues/321#issuecomment-224692478