Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Fun fact: for servers that are not too particular about the Content-Type they receive or the presence of extra object attributes, it is also possible to submit (fixed) well-formed JSON using HTML forms with no JavaScript and a dash of hackery.

  <form method="POST" enctype="text/plain" action="http://example.com">
  <input name='{"key1":"val1","params":{"input":"value","list":[],},"dummy":"' value='"}' hidden>
  <button>Submit</button>
  </form>
The important bit is to include a "dummy" key at the end of the JSON object, and an input value that closes the quotes and any open curl braces. That way the "=" character sent in the encoding of the form elements doesn't interfere with the meaningful JSON content.

There might be a clever way to get it to submit dynamic JSON that changes based on user input without JavaScript, but I haven't thought enough about it.

This technique is sometimes useful for CSRF attacks.



What exactly is the point of this when you could have pure JSON as a hidden form value without any of the "hacks" or worries about content type...


If I understand what you're asking: this trick is useful for submitting data to API endpoints that expect the entire request to be well-formed JSON, rather than just a small part. The (pretty-printed) POST body from the example form in my previous comment will look like a regular JSON request as far as the destination server is concerned, with the addition of a "dummy" key:

  {
    "key1": "val1",
    "params": {
      "input": "value",
      "list": []
    },
    "dummy": "="
  }
If the JSON is just a hidden form value as you suggest, the request as a whole will not be treated as JSON data. Then invalid characters will (usually) be added to the request body by the browser, and the server will (probably) be unable to parse it, causing the request to fail. This is due to how forms are encoded for POST requests.

On the other hand, if you're wondering why anyone would ever do this, then I do not have a good answer for you :)




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: