This isn't about JSON at all, but about cross-site scripting.

ipetepete · on March 27, 2013

The title threw me for a loop. I was like "OHNOES!" I must secure my JSONs probably with some XMLs. Then I was like oh...

tlrobinson · on March 27, 2013

No, it's not. XSS is about injecting JavaScript in 3rd party sites to bypass the same origin policy.

This is about loading 3rd party JSON APIs on the attacker's site using other ways of bypassing SOP.

The first vulnerability (CSRF) isn't specific to JSON APIs, but the second one is.