In my rich client, I escape user-provided data before rendering to prevent XSS.
The data comes from the server unescaped. That is necessary for application logic, e.g., avoiding situations where I mistakenly check
Yet an attacker can send the user a link to direct
GET access to the underlying JSON API; or the user might stumble upon it. This enables XSS.
How do I prevent this? CSRF tokens? Setting content-type to plaintext or JSON and not HTML? Some other approach?