RFC 8259

RFC 8259
Title	RFC 8259
Subject	JSON Data Interchange Format
Author	Douglas Crockford, et al.
Published	December 2017
Status	Standards Track

RFC 8259

RFC 8259 is a standards-track document that specifies the JavaScript Object Notation (JSON) text format for data interchange. It provides normative guidance for interoperable encoding and decoding across implementations and clarifies ambiguities from earlier documents. The specification influences a wide range of Internet Engineering Task Force work, World Wide Web Consortium technologies, and programming language libraries used by organizations such as Google, Microsoft, Apple Inc., Amazon (company), and Mozilla.

Background

RFC 8259 arose from efforts within the Internet Engineering Task Force to consolidate and clarify the JSON format originating from work by Douglas Crockford and the JavaScript community. The document interacts with milestones in the development of web standards like ECMAScript, Hypertext Transfer Protocol, and XML. It reflects input from contributors affiliated with institutions including Oracle Corporation, IBM, Cisco Systems, Red Hat, and academic groups from Massachusetts Institute of Technology, Stanford University, and University of California, Berkeley. The RFC situates JSON with respect to prior specifications such as the experimental JSON descriptions in the IETF Standards Track and aligns with pragmatic needs of projects like Node.js, Apache HTTP Server, and Nginx.

Specification

RFC 8259 defines the concrete syntax and canonical interpretation of JSON texts, addressing details that affect serializers and parsers. The specification references formal grammars found in efforts analogous to those used by ISO/IEC, IETF BCP 14, and syntactic conventions adopted in ECMA-404. It prescribes normative processing rules intended to enable interoperability among implementations maintained by entities including GitHub, Facebook, Twitter, LinkedIn, and large-scale deployments by Netflix. The rules govern character encoding, structural composition, and error handling, providing authorative guidance for projects such as SQLite, PostgreSQL, MongoDB, and Redis which embed JSON processing.

Data Types and Encoding

RFC 8259 specifies a small set of data constructs: objects, arrays, numbers, strings, true, false, and null. Numeric representation is informed by standards used in IEEE 754 floating-point arithmetic and by language ecosystems like C++, Java (programming language), Python (programming language), Ruby (programming language), and Perl. String encoding is tied to Unicode code points and the UTF-8 encoding form, impacting clients and servers including Android (operating system), iOS, Windows networking stacks, and embedded platforms such as ARM-based devices. The document also constrains escape sequences and control character handling, affecting libraries maintained by Google Chrome, Electron (software framework), Django, Ruby on Rails, and Spring Framework.

Security Considerations

RFC 8259 highlights risks that arise when JSON texts are used in contexts like inter-process communication, web APIs, and configuration files. Security concerns intersect with work by Open Web Application Security Project and protocols such as OAuth 2.0, TLS, and OAuth. Risks include parser vulnerabilities, injection attacks exploited in environments like Apache Tomcat, IIS (Internet Information Services), and NGINX Unit, and issues in cross-origin scenarios governed by Same-Origin Policy and Content Security Policy. The document advises implementers associated with projects like OpenSSL, LibreSSL, GnuTLS, and operating systems including Linux, FreeBSD, and macOS to consider input validation, memory safety, and denial-of-service mitigations.

Implementations and Interoperability

RFC 8259 is implemented across a broad ecosystem of software: language runtimes such as V8 (JavaScript engine), SpiderMonkey, ChakraCore, and JVM-based libraries; database systems including MySQL, Cassandra (database), and Elasticsearch; and frameworks like ASP.NET, Express (web framework), and Flask (web framework). Compliance with the RFC affects interoperability among services run by Dropbox, Slack Technologies, Salesforce, and governmental agencies following guidance from National Institute of Standards and Technology in contexts where JSON is used for telemetry and logging. Test suites and fuzzing efforts from groups like OSS-Fuzz and academic labs at Carnegie Mellon University and ETH Zurich exercise parser implementations to discover deviations and vulnerabilities.

History and Revisions

The evolution culminating in RFC 8259 traces back to early JSON publication and community consolidation led by Douglas Crockford and the JSON.org initiative, followed by formalization efforts in RFCs and an errata process maintained by the IETF JSON Working Group. Subsequent revisions and clarifications have been influenced by operational feedback from large-scale deployments at Facebook, Google Cloud, and Amazon Web Services, and by interaction with standardization bodies such as ITU and ISO. The document sits within a lineage that includes informational and standards-track publications and continues to be referenced by newer specifications that adapt JSON for specialized use in areas like Internet of Things, WebSocket, and GraphQL.

Category:Internet standards