JSON is static content. Open an HTML page you trust and have that load the JSON data you want and use it to populate the DOM, making sure to escape HTML characters so it can't inject script tags and such.
The point is to be able to guarantee properties of a resource that is delivered to you via the internet. Whether it contains JSON or not, you are trusting the server. With current web technology you don't have an option.
Comments
JSON is static content. Open an HTML page you trust and have that load the JSON data you want and use it to populate the DOM, making sure to escape HTML characters so it can't inject script tags and such.
The point is to be able to guarantee properties of a resource that is delivered to you via the internet. Whether it contains JSON or not, you are trusting the server. With current web technology you don't have an option.