Why Google prepends while(1); to JSON and how not to fall for it

Why Google prepends while(1); to JSON and how not to fall for it: top JavaScript developer mistakes

If you've ever looked into the developer console while working with Google APIs or simply googled strange server responses, you've probably noticed something like:

while(1);["some","data"]

Looks like an infinite loop that would hang the browser, right? But in reality, it's a brilliant security mechanism. Let's figure out why Google prepends while(1) to JSON, what mistakes developers make when working with such responses, and how to avoid them.

This question is one of the most popular on Stack Overflow (thousands of views), and for good reason. It touches not only on technical nuances but also on fundamental principles of web security.

What is while(1); in JSON and where did it come from?

Let's start with the main point. Google prepends while(1) to JSON not to break your code, but to protect against an attack called JSON Hijacking.

Imagine the good old days when websites used top-level JSON arrays (e.g., [{"user":"admin","token":"secret"}]). An attacker could override the global Array or Object constructor and steal data via a <script> tag. The browser would execute the JSON as JavaScript, and the data would leak.

Google's solution was to add the while(1); prefix. This makes the JSON invalid JavaScript (the infinite loop prevents malicious script execution), but the JSON itself remains valid — you just need to parse it correctly by removing the prefix.

Today, this practice has become a security standard for many large APIs. But if you don't know about it, your code might break.

Top 5 JavaScript developer mistakes when working with protected JSON

Mistake #1: Trying to parse the response as-is

The most common mistake — a developer receives a server response and immediately passes it to JSON.parse(). The result is a parsing error because while(1); is not valid JSON.

fetch('https://api.google.com/some-endpoint')  .then(response => response.text())  .then(data => {    // Error! JSON.parse will fail    const parsed = JSON.parse(data);    console.log(parsed);  })  .catch(err => console.error('Parsing error:', err));

How to avoid: Always remove the while(1); prefix before parsing.

fetch('https://api.google.com/some-endpoint')  .then(response => response.text())  .then(data => {    // Remove the security prefix    const cleanJson = data.replace(/^\\)?\\s*while\\s*\\(\\s*1\\s*\\)\\s*;\\s*/, '');    const parsed = JSON.parse(cleanJson);    console.log(parsed);  })  .catch(err => console.error('Parsing error:', err));

Mistake #2: Using response.json() without handling

The response.json() method in the Fetch API expects clean JSON. If the server returns while(1);..., then response.json() will throw an exception. Developers often think this is an API bug rather than a security feature.

// This code will fail with "Unexpected token w"fetch('https://api.google.com/endpoint')  .then(response => response.json()) // Error!  .then(data => console.log(data));

How to avoid: Use response.text() and then manually remove the prefix.

fetch('https://api.google.com/endpoint')  .then(response => response.text())  .then(text => {    const jsonText = text.replace(/^\\)?\\s*while\\s*\\(\\s*1\\s*\\)\\s*;\\s*/, '');    return JSON.parse(jsonText);  })  .then(data => console.log(data));

Mist