title: Json Hijacking with Ajax Jquery post request
body: <p>Yesterday, I read some nice articles about how to prevent <a href="http://haacked.com/archive/2009/06/24/json-hijacking.aspx" rel="noreferrer">Json Hijacking with Asp.Net MVC</a>. The rule is: never send sensible data in json format over a get request. With a simple search on google, you can easily learn how to define a script that will be use to extract data from another use with the help of his auth cookie.</p>
  
  <p>But after reading all these articles, I don't know why it's not possible to do Json Hijacking with Ajax Jquery post request. I read that Ajax requests are subject to the same origin policy but JQuery have a property to be able to do cross-domain request.</p>
  
  <p>In this case, is it possible to do Json Hijacking with a script using $.postJSON on the document ready event? If yes or no, could you explain my exactly why?</p>
  
  <p>Here is a simple bunch of code to do what I'm thinking:</p>
  
  <pre><code>$.postJSON = function (url, data, callback) {
     $.post(url, data, callback, "json");
  };
  
  &lt;script&gt;
      $(function(){
         $.postJSON("/VulnerableSite/ControllerName/ActionName", 
           { some data parameters }, function() {
           // Code here to send to the bad guy the data of the hacked user. 
           }
      });
  &lt;/script&gt;
  </code></pre>
  
  <p>Thank you very much.</p>