17

I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web page, where should i perform encoding of user input data (i.e. untrusted data)? Currently i am encoding data into my REST Controller before returning the response. I am following OWASP XSS Prevention cheat sheet article. But since in my scenario, everything is ajax calls and data fetching from json and putting into html using jquery, not sure about where should user encoder to encode untrusted data. Is putting encoding in REST Controller is good option?

Thank you in advance.

Improve this question

1 Answer 1

Reset to default
30

If the REST API purely returns JSON (and never HTML) then do the HTML escaping client-side, in JavaScript.

Whether the client's HTML page uses JQuery templating, or builds up HTML with calls to functions like .html() neither of these by default have XSS protection. One approach is for the client code to explicitly call an escaping function on all untrusted input. However, an approach I prefer is to use a JQuery plugin that does automatic escaping. Here are two approaches for this:

People may criticise this approach, saying "you can't rely on client-side control for security". That criticism is based on misunderstanding; in this particular instance you can rely on it.

It's notable that AngularJS includes automatic escaping by default. If they wrote JQuery from scratch today, I expect JQuery would also include this.

One of the reasons not to do HTML escaping in the REST API is that you may have a non-HTML client consuming the API. In that case you definitely don't want HTML escaping to be applied.

It is important you return JSON using the correct Content-Type header (application/json) to avoid API misuse attacks.

Improve this answer
16
  • 1
    +1 for understanding what XSS actually is. Thank you!
    – Adi
    Oct 28, 2013 at 10:04
  • 4
    You seem to be ignoring the scenario of API misuse. i.e. I send you a link to the REST API, which returns "not html" (except that it does have HTML / script, thats the point of XSS). Sure, the API should never be browsed to, but that's the point - the attacker doesnt play by your rules.
    – AviD ♦
    Oct 28, 2013 at 10:11
  • 2
    @AviD Verify if the request is coming from an Ajax request. Done, done, and problem solved.
    – Adi
    Oct 28, 2013 at 10:15
  • 4
    @AviD if you return JSON with the correct Content-Type header then a modern browser will never interpret it as script. I have edited my answer to make this clearer.
    – paj28
    Oct 28, 2013 at 10:17
  • 2
    @Physics-Compute that isn't an appropriate comment for the question. The server should definitely sanitise its inputs to protect itself (so if it stores data in a SQL database it should sanitise for that) but it shouldn't necessarily sanitise for every rendering vulnerability any possible client of its could experience. That's the context of this question.
    – Rob Grant
    Apr 21, 2018 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .