[symfony#2212] Adding a note about JSON hijacking

weaverryan · weaverryan · commit 85db41836b84 · 2013-04-26T09:34:01.000-05:00
diff --git a/components/http_foundation/introduction.rst b/components/http_foundation/introduction.rst
@@ -446,8 +446,20 @@ class, which can make this even easier::
     ));
 
 This encodes your array of data to JSON and sets the ``Content-Type`` header
-to ``application/json``. If you're using JSONP, you can set the callback
-function that the data should be passed to::
+to ``application/json``.
+
+.. caution::
+
+    To avoid `JSON Hijacking`_, you should pass an associative array as the
+    outer-most array to ``JsonResponse`` and not an indexed array so that
+    the final result is an object (e.g. ``{"object": "not inside an array"}``)
+    instead of an array (e.g. ``[{"object": "inside an array"}]``).
+
+JSONP Callback
+~~~~~~~~~~~~~~
+
+If you're using JSONP, you can set the callback function that the data should
+be passed to::
 
     $response->setCallback('handleResponse');
 
@@ -464,3 +476,4 @@ Session
 The session information is in its own document: :doc:`/components/http_foundation/sessions`.
 
 .. _Packagist: https://packagist.org/packages/symfony/http-foundation
+.. _`JSON Hijacking`: http://haacked.com/archive/2009/06/25/json-hijacking.aspx
