JSONResponse allows types other than dict to be serialized without an explicit opt in

Checklist

• The bug is reproducible against the latest release and/or master.
• There are no similar issues or pull requests to fix it yet.

Describe the bug

JSONResponses that are not dicts have a number of disadvantages, such as violating SOP on ES5 browsers and preventing future extension

Additional context

django does this https://github.com/django/django/blob/ca9872905559026af82000e46cde6f7dedc897b6/django/http/response.py#L579-L604

https://twitter.com/simonw/status/1410682522908856320

[chbndrhnns]

I am not @graingert but I remember reading http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ and https://stackoverflow.com/questions/3503102/what-are-top-level-json-arrays-and-why-are-they-a-security-risk on that topic.

[adriangb]

Right agreed it’s good practice! And it’s what I’d do in any real app. The only situation in which I find myself returning something else is tests. But from above it sounded like there’s issues that go deeper than good design, I wasn’t aware of them so just hoping to learn something. But it seems like indeed the main remaining reason is that it’s a footgun for users that aren’t aware of the consequences of returning a non-extensible response. In that case I agree with @tomchristie: I’m not sure I’d want that enforced on me.