Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is applied) and return the transformed version of the input. What are the security concerns with this?

Further assumptions:

  • The content type does not need to be text/html (currently I have text/plain)
  • A user should be logged in and this can be validated
  • The site is loaded over SSL, no insecure resources loaded
  • This is already behind a referer-check filter to help mitigate CSRF

I don't think this will need to make it to a production environment but while I was considering the ramifications, I didn't come up with much so it piqued my interests.

  • Referer checks to prevent CSRF are problematic. See OWASP.
    – Anders
    Apr 20, 2016 at 19:31

1 Answer 1


Assuming stored XSS were possible, the stored XSS could use the echo endpoint to present a phishing version of the site (since further XSS resource loading through the echo would be permitted and trusted due to the same origin it was coming from).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .