Under some circumstances (GET requests for JSON-serialized data), it is possible for a malicious site to hijack personal data. More about this can be found in this document. OAT provides support for preventing these attacks. To make your web application invulnerable to such attacks, use the following:
oatSecurityCookie
to a random value. The same value is appended to a query string. Server endpoint is encouraged to
compare these two values and verify that they don't differ. This guarantees that the request was made from the correct page.
while(1);
construct, located at the beginning of JSON text,while(1);/*{[ {"name":"safe value 1"}, {"name":"safe value 2"}, ... ]}*/