I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web page, where should i perform encoding of user input data (i.e. untrusted data)? Currently i am encoding data into my REST Controller before returning the response. I am following OWASP XSS Prevention cheat sheet article. But since in my scenario, everything is ajax calls and data fetching from json and putting into html using jquery, not sure about where should user encoder to encode untrusted data. Is putting encoding in REST Controller is good option?
Thank you in advance.