I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response.
This is open to XSS if the response is rendered as HTML by the browser since someone could add arbitrary HTML to the request object.
What is the standard way to mitigate this? Current options I can think of are:
- Only allow requests with
X-Requested-With: XMLHttpRequestheader to stop attacks that rely on non-ajax requests to my service
- Send the response with content type
application/jsonand hope the browser refuses to render this as HTML
- Encode unsafe characters in the response (how do I do this? using \uxxxx?)
I have been unable to find a concrete reference on this.