I was wondering if below GET requests from a HTML file and a javascript file, are vulnerable to AJAX Hijacking/JavaScript Hijacking?
AJAX Hijacking: http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ JavaScript Hijacking: http://www.net-security.org/dl/articles/JavaScript_Hijacking.pdf
1)
var req = new XMLHttpRequest();
req.open("GET", queryUrl, false);
req.setRequestHeader("Accept", "application/json");
req.setRequestHeader("Content-Type", "application/json; charset=utf-8");
req.onreadystatechange = function () {
if (this.readyState == 4) {
if (this.status == 200) {
//do something }
}
}
req.send();
2)
var req = new XMLHttpRequest();
req.open("GET", encodeURI(ODataPath() + type + "Var1"+ Value1+"), true);
req.setRequestHeader("Accept", "application/json");
req.setRequestHeader("Content-Type", "application/json; charset=utf-8");
req.onreadystatechange = function () {
if (this.readyState == 4 /* complete */) {
req.onreadystatechange = null;
// Do Something
};
req.send();
};