Contents
Does JSON prevent XSS?
The potential XSS vulnerability can be avoided by using the correct Content-Type. All JSON responses should use the application/json type. The nosniff header is used to disable content-sniffing on old versions of Internet Explorer.
Can XSS happen in JSON?
A final conclusion would be XSS will not be possible when content-type is set to application/json in modern browsers.
What is Post XSS?
This reflected XSS would execute after making a POST request with an XSS payload in the path of the request. As a result, the server would directly insert the payload into the response, allowing the XSS to trigger on the page.
Is it possible to XSS exploit JSON responses with proper?
Google famously traps JSON response direct sourcing by prefixing all JSON with something like: And then the rest of the JSON follows. So Dr. Evil cannot, using the sort of exploit discussed here http://sla.ckers.org/forum/read.php?2,25788 get your cookie (assuming you’re logged in) by putting the following on his site:
Is there a reflected XSS flaw in my application?
There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the JSON object is directly used by client side Javascript and hence the flaw.
How can I prevent reflected XSS in my JSON Web Services?
Set the Content-Type to application/json, and set X-Content-Type-Options: nosniff (the last header instructs the browser to use the given content-type – no extra guessing). You could even consider adding a Content-Disposition: attachment header.
How can I exploit a web application if content sniffing is?
This means that the receiver may or may not take action based on that header. A typical browser will read the content type header to render the content in the best possible way (JSON as a tree, audio stream as a player, etc.). Try to send a JSON string to a browser with Content-Type: application/json and without.