fetchJSON removes security prefix on 200 response but not on fetch error cases

[gabrielslach]

Expected behavior

fetchJSON should return valid JSON for all types of response (regardless if response code of 200 or not)

Actual Behavior

• fetchJSON returns valid JSON only on successful requests (response code 200). In cases where the response body is prefixed by a security substring, the prefix is removed before the response body is returned.

• However, in cases where fetch() throws an error and the (error) response body is prefixed by a security substring, the prefix is not removed.

• Issue is that the handling of the security prefix (for error responses) would need to be implemented again/separately outside the package.

• Since for successful response, fetchJSON handles the removal of the security prefix, shouldn't it also do the same for error responses?

Additional context

ajax: 1.0.0