1

This question already has an answer here:

I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?

marked as duplicate by Community Dec 12 '18 at 2:39

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • no, please don't 2nd-guess devs by altering input. – dandavis Dec 12 '18 at 17:34
0

Its up to the data consumer to sanitize data so perhaps you supply a document of potential risks that come from using your API.

For example where does your API get its data? Are you sanitizing the data? Is that a risk the consumer might need to know and how would they mitigate the risk.

Not the answer you're looking for? Browse other questions tagged or ask your own question.