I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, so it's formatted according to JSON rules and the neccessary special characters are escaped.
A security researcher reported to me that <
and >
are not escaped in the output, so if an attacker did a request such as HTTP POST https://my.api.example.com/blabla with the JSON body {Value:"<Hello>"}
then my API will output something like {Response:"<Hello> is not a valid value"}
.
The security researcher then explained that an attacker may be able to do a Reflected Cross-site scripting by using this.
My JSON API always returns a Content-Type: application/json
header so my understanding is that modern clients will not try to interpret it as HTML.
<
and >
are valid characters in my API so I can't filter it out. One option would be to encode the characters it in the output, but HTML-encoding characters in a JSON API seems a bit strange to me. A third option would be to just remove the string from the output and instead say something like "The provided value was not valid", but that would reduce usability a bit.
Are there any good common practices how to handle this?