Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web page, where should i perform encoding of user input data (i.e. untrusted data)? Currently i am encoding data into my REST Controller before returning the response. I am following OWASP XSS Prevention cheat sheet article. But since in my scenario, everything is ajax calls and data fetching from json and putting into html using jquery, not sure about where should user encoder to encode untrusted data. Is putting encoding in REST Controller is good option?

Thank you in advance.

share|improve this question

1 Answer 1

If the REST API purely returns JSON (and never HTML) then do the HTML escaping client-side, in JavaScript.

Whether the client's HTML page uses JQuery templating, or builds up HTML with calls to functions like .html() neither of these by default have XSS protection. One approach is for the client code to explicitly call an escaping function on all untrusted input. However, an approach I prefer is to use a JQuery plugin that does automatic escaping. Here are two approaches for this:

People may criticise this approach, saying "you can't rely on client-side control for security". That criticism is based on misunderstanding; in this particular instance you can rely on it.

It's notable that AngularJS includes automatic escaping by default. If they wrote JQuery from scratch today, I expect JQuery would also include this.

One of the reasons not to do HTML escaping in the REST API is that you may have a non-HTML client consuming the API. In that case you definitely don't want HTML escaping to be applied.

It is important you return JSON using the correct Content-Type header (application/json) to avoid API misuse attacks.

share|improve this answer
    
+1 for understanding what XSS actually is. Thank you! –  Adnan Oct 28 '13 at 10:04
    
You seem to be ignoring the scenario of API misuse. i.e. I send you a link to the REST API, which returns "not html" (except that it does have HTML / script, thats the point of XSS). Sure, the API should never be browsed to, but that's the point - the attacker doesnt play by your rules. –  AviD Oct 28 '13 at 10:11
1  
@AviD Verify if the request is coming from an Ajax request. Done, done, and problem solved. –  Adnan Oct 28 '13 at 10:15
2  
@AviD if you return JSON with the correct Content-Type header then a modern browser will never interpret it as script. I have edited my answer to make this clearer. –  paj28 Oct 28 '13 at 10:17
    
Yup, now I can feel good about upvoting this :-) –  AviD Oct 28 '13 at 10:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.