So here is the thing, friend of mine told me that our json data could be leaked from client side by injecting json as oururl if our clients are logged in. below is the sample get request that should be made by our clients only.
he also warned me that our api url could framed on which is obviously should not have concern with any security measurement right?
can anyone describe how could attacker get this data via json hijacking? i thought modern browsers are secure enough to prevent these kind of attacks.
any help would be appreciated!
sample api get requests url : https://www.example.com/accounts/edit/
{"form_data": {"first_name": "firstname", "last_name": "surname", "email": "emailid@emailprovider.com", "username": "username", "phone_number": "+xx xxxxx xxxxx"}}
