Does the Microsoft JSON object serialization differ from the "normal" serialization?

Question

I recall hearing that the way Microsoft had to implement the JSON serialization for their AJAX framework was different than most other libraries out there. Is this true? And, if so, how is it different?

Answer 1

I'm not sure about anything else, but I did read about some tinkering they had to do to make date/time work (see post).

Answer 2

There are a couple of difference, both of which are related to security. The first is that their webservices, by default, will only accept http POSTs. This is done to prevent JSON hijacking. You can disable this, and read more about it here.

The second difference pertains to the returned data. If you use a create your webservice in code-behind by decorating a static object with a [WebMethod] attribute, the return JSON is wrapedin an object naemd 'd'. This is to prevent JSON array constructor attacks.

And yes, while these represent the Right Thing To Do (tm), they can make it difficult to interact with third party libraries.

Answer 3

As @Chris said, there isn't anything special other than how Dates are handled. the JSON specification does not have a native way in which dates are to be serialised.

If you do not have any dates being returned in your JSON string you can use what ever deserializer you wish. The MS AJAX one is nice as it does have a way to varify the JSON string is valid first.