JSON users: Avoid CSRFs by not using top-level arrays

186 points by Jach

Read the article

Discussion on Hacker News