JSON Hijacking [XSSI]

http://balpha.de/2013/02/plain-text-considered-harmful-a-cross-domain-exploit/

http://blog.portswigger.net/2016/11/json-hijacking-for-modern-web.html

https://www.owasp.org/images/f/f3/Your_Script_in_My_Page_What_Could_Possibly_Go_Wrong_-_Sebastian_Lekies%2BBen_Stock.pdf

https://www.owasp.org/images/6/6a/OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes.pdf