diff --git a/src/aphront/response/AphrontAjaxResponse.php b/src/aphront/response/AphrontAjaxResponse.php
index 1736c96898..0aab0ffdf2 100644
--- a/src/aphront/response/AphrontAjaxResponse.php
+++ b/src/aphront/response/AphrontAjaxResponse.php
@@ -67,7 +67,7 @@ final class AphrontAjaxResponse extends AphrontResponse {
       $this->error);
 
     $response_json = $this->encodeJSONForHTTPResponse($object);
-    return $this->addJSONShield($response_json, $use_javelin_shield = true);
+    return $this->addJSONShield($response_json);
   }
 
   public function getHeaders() {
diff --git a/src/aphront/response/AphrontJSONResponse.php b/src/aphront/response/AphrontJSONResponse.php
index 32984bfd13..5e820cc5ed 100644
--- a/src/aphront/response/AphrontJSONResponse.php
+++ b/src/aphront/response/AphrontJSONResponse.php
@@ -44,7 +44,7 @@ final class AphrontJSONResponse extends AphrontResponse {
   public function buildResponseString() {
     $response = $this->encodeJSONForHTTPResponse($this->content);
     if ($this->shouldAddJSONShield()) {
-      $response = $this->addJSONShield($response, $use_javelin_shield = false);
+      $response = $this->addJSONShield($response);
     }
     return $response;
   }
diff --git a/src/aphront/response/AphrontResponse.php b/src/aphront/response/AphrontResponse.php
index 437fb9df85..824bba2efa 100644
--- a/src/aphront/response/AphrontResponse.php
+++ b/src/aphront/response/AphrontResponse.php
@@ -85,7 +85,7 @@ abstract class AphrontResponse {
     return $response;
   }
 
-  protected function addJSONShield($json_response, $use_javelin_shield) {
+  protected function addJSONShield($json_response) {
 
     // Add a shield to prevent "JSON Hijacking" attacks where an attacker
     // requests a JSON response using a normal <script /> tag and then uses
@@ -93,11 +93,7 @@ abstract class AphrontResponse {
     // This header causes the browser to loop infinitely instead of handing over
     // sensitive data.
 
-    // TODO: This is massively stupid: Javelin and Conduit use different
-    // shields.
-    $shield = $use_javelin_shield
-      ? 'for (;;);'
-      : 'for(;;);';
+    $shield = 'for (;;);';
 
     $response = $shield.$json_response;
 
diff --git a/src/applications/auth/oauth/provider/PhabricatorOAuthProviderPhabricator.php b/src/applications/auth/oauth/provider/PhabricatorOAuthProviderPhabricator.php
index 44173470df..08f65639d8 100644
--- a/src/applications/auth/oauth/provider/PhabricatorOAuthProviderPhabricator.php
+++ b/src/applications/auth/oauth/provider/PhabricatorOAuthProviderPhabricator.php
@@ -104,6 +104,10 @@ extends PhabricatorOAuthProvider {
   }
 
   public function setUserData($data) {
+    // legacy conditionally strip shield. see D3265 for discussion.
+    if (strpos($data, 'for(;;);') === 0) {
+      $data = substr($data, 8);
+    }
     $data = idx(json_decode($data, true), 'result');
     $this->validateUserData($data);
     $this->userData = $data;