title: Is the JSON CSRF/Theft attack still possible?
body: <p>I read this article: <a href="http://jeremiahgrossman.blogspot.com/2007/01/gmail-xsrf-json-call-back-hackery.html" rel="noreferrer">http://jeremiahgrossman.blogspot.com/2007/01/gmail-xsrf-json-call-back-hackery.html</a></p>
  
  <p>And I tried to use the technique, but it seems to fail on (at least) most browsers I tried. Basically you return JSON on your site and someone else does a <code>&lt;script src="domain.com/response.php?json"&gt;&lt;/script&gt;</code> and then you setup your own object/array constructors to steal the data.</p>
  
  <p>Is this still viable with modern browsers? Should I use tokens to prevent this?</p>