I'm building a rest API that serves exclusively JSON. It might one day be consumed by a browser based app. Is there anything I should do on my end to prevent XSS attacks?

  • no, please don't 2nd-guess devs by altering input. – dandavis Dec 12 '18 at 17:34

Its up to the data consumer to sanitize data so perhaps you supply a document of potential risks that come from using your API.

For example where does your API get its data? Are you sanitizing the data? Is that a risk the consumer might need to know and how would they mitigate the risk.

Not the answer you're looking for? Browse other questions tagged or ask your own question.