Twitter Search API

Very similar in concepts to some of the work I have been doing in PageForest.

Quoted: Apache,CouchDB is a distributed, fault-tolerant and schema-free document-oriented database accessible via a RESTful HTTP/JSON API.

JSON API documention for my URL shortening service, g02.me.

FriendFeed API has client-side JSON as well as uthenticated HTTP using a "Remote Key" that is unique to each user.

Also, Python and PHP API libraries here:

http://code.google.com/p/friendfeed-api/

I'd like to use the Summize API to build a nice Twitter widget in StartPad.org.

Quoted: Adopting that concept I have been experimenting with a set of transformation rules (written in JSON).
...
As a result in analogy to XML/XSLT the combination JSON/JSONT can be used to transform JSON data into any other format by applying a specific set of rules.

Proposal to implement a JSONRequest object in every browser. Proposed method supports anonymous sending and reveiving of JSON (no cookies transmitted), and therefor exempts from the same-origin policy of XMLHttpRequest.

Rather than use aspx file, create handlers to respond to RSS, and JSON requests, w/o the overhead of the Web Forms architecture.

Good reference to a paper on cross-site scripting vulnerabilites is AJAX code.

http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf

The attack using a hook to capture any event that sets a know property:

function Object()
{
this.email setter = captureObject;
}

Note the flame-war between antibozo and kentaromiura in the comments. It actually resolves itself quite amicably in the end.

Quoted: An application can be mashup-friendly or it can be secure, but it cannot be both.
...
Solutions:
o Include a hard-to-guess identifier, such as the session identifier, as part of each request
that will return JavaScript. This defeats cross-site request forgery attacks by allowing the
server to validate the origin of the request.
o Include characters in the response that prevent it from being successfully handed off to a
JavaScript interpreter without modification. This prevents an attacker from using a
<script> tag to witness the execution of the JavaScript.

Vulnerable frameworks include: Prototype, Script.aculo.us, Dojo, Moo.fx, jQuery, Yahoo! UI, and MochiKit.