title: Struts2 JQuery grid JSON result hijacking
body: <p>I am using struts2 jquery grid in my current project.The <code>dataType</code> used in jquery grid is <code>json</code>. Everything works like charm. There was a security audit of my application and they pinpointed the <strong>JSON Hijacking vulnerability</strong>. I searched the internet for mitigating the json hijacking in general &amp; solution in struts2. I quite fing good documentation.
    <a href="http://haacked.com/archive/2009/06/25/json-hijacking.aspx/" rel="nofollow">Json Hijacking</a> </p>
  
  <p><a href="https://cwiki.apache.org/confluence/display/WW/JSON+Plugin" rel="nofollow">Prevent Struts2 from JSON Hijacking </a></p>
  
  <p>I used the prefix param set to true in json result type in struts.xml. All is working fine , i got the json data prefixed with {}&amp;&amp;. As described in <strong>Link 2</strong> this is used to mitigate the json hijacking.</p>
  
  <p>The problem i faced is that jQuery Grid is not able to load Data.</p>
  
  <p>My struts.xml</p>
  
  <pre><code>&lt;action name="myjson" class="action.JsonTable"&gt;
  &lt;result type="json"&gt;
  &lt;param name="prefix"&gt;true&lt;/param&gt;
  &lt;/result&gt;
  </code></pre>
  
  <p>The grid is not able to populate.Wen i remove <code>&lt;param name="prefix"&gt;true&lt;/param&gt;</code> from the action defnition, everything works fine. But it is vulnerable :(</p>