We Built Guardrails Against JSON Precision Loss. Then We Found Out Half of Them Weren't Actually Guarding Anything.
A few weeks ago I ran this through our own JSON repair tool, in the browser, on our own website: json { "id" : 22233344455566677788 } It came back as: json { "id" : 22233344455566676000 } No error. No warning. Just a quietly wrong number, presented as a successful repair. That number is a made-up snowflake ID, the kind of thing you'd see as a primary key in a distributed system. And our own tool…
A JSON repair tool, designed to prevent incorrect results, silently corrupted a made-up snowflake ID during testing. This issue occurs because JSON has only one number data type, which JavaScript also uses, and cannot distinguish between integers and floats. Once a number is parsed into a JavaScript Number, its original precision is lost, and there's no way to reconstruct it.
Systems like Twitter and Stripe have addressed this by providing both numeric and string IDs, while pandas has had unresolved issues with JSON.mangling large integers. The JSON repair tool the company built had a guard to reject requests with non-precise numbers, but it wasn't implemented in the browser client versions. After testing, they discovered that three out of four browser pages let oversized numbers pass through.
They had designed the large-integer check to be non-blocking, logging the error instead of rejecting the request, but decided to change it to reject before parsing, ensuring no precision loss. Now, the server and browser tools both check for large integers and reject requests with non-precise numbers, providing a clear error message instead of a silently corrupted result.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
