Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is applied) and return the transformed version of the input. What are the security concerns with this?
- The content type does not need to be text/html (currently I have text/plain)
- A user should be logged in and this can be validated
- The site is loaded over SSL, no insecure resources loaded
- This is already behind a referer-check filter to help mitigate CSRF
I don't think this will need to make it to a production environment but while I was considering the ramifications, I didn't come up with much so it piqued my interests.