I am performing security testing on a REST API and it is a POST method. I injected an XSS script in a body parameter and the API responded with '200 success' response with the actual expected data.

If the response is '200 OK' and response body displays with the actual response as result, then I would have concluded this as a vulnerability, because the XSS script would have been stored and reacted when the respective page is opened in a web browser (if the web application is also weak in security). So can we consider this as a vulnerability?

1 Answer 1


It depends.

If the purpose of this API is to support an editor for HTML, JavaScript, CSS, then it may be fine that the API returns a script. Because if you develop such an editor, you know that you should not embed the API response as is. But even for an editor it is not the best approach to return HTML and JavaScript. Escaping such content can be safer.

If the API purpose is not an HTML editor, then one should expect that some clients will embed the response into DOM as is. Returning a script is a security issue in such case. Even if some frontend frameworks like Angular and React provide possibility to prevent XSS, there is no guarantee that particular client implementation really uses it in all relevant case. That's why the API should do as much as possible to prevent XSS. The typical options are:

  • Reject the request that contains potentially dangerous code (HTML, JavaScript, CSS).
  • Accept such request, but filter any dangerous code out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .