Why does Google add while 1 at the start of their JSON responses

Question

With the help of code, can you explain why Google adds while(1) at the start of their JSON responses?

Answer 1

Google often adds while(1); (or a similar infinite loop statement) at the start of their JSON responses to prevent JSON hijacking.

Reason: JSON Hijacking Prevention

JSON data can be evaluated as JavaScript code using the eval() function.

If a malicious site includes the JSON response directly in a <script> tag, it could potentially expose sensitive data.

By adding while(1);, the JSON response becomes invalid JavaScript and cannot be executed directly.

Example:

Response from Google:

while(1);{ "data": "example" }

This invalidates the response when parsed as JavaScript, protecting it from being exploited as a data source by malicious scripts.