When working with JSONs in Angular, it is recommended to prefix them with )]}'\n for added protection against potential JSON vulnerability:
A JSON vulnerability could allow a third-party website to transform your JSON resource URL into a JSONP request under certain conditions. To prevent this, your server can add the string ")]}',\n" before all JSON requests. Angular will then remove this prefix automatically before processing the JSON.
However, the article does not mention these closing brackets, making it seem like they could be easily bypassed (as demonstrated by my patched JSONView Chrome plugin stripping them out). Why wouldn't this workaround be effective for an 'attacker'?
Instead, the suggested approach is to wrap the JSON within an object:
{"d": ["Philha", "my-confession-to-crimes", 7423.42]}
According to the article, this method offers better protection.
Why does AngularJS prefer this unconventional form of protection, and does it actually work? Testing this out may provide some clarity.