XSS Cross-Site Scripting – Java Backend Security
Fast recall
Quick revision
Core answer
Content-Type: application/json does not normally execute its strings, so a pure API response is not itself an HTML sink. XSS appears when a browser client later inserts an attacker-controlled JSON value into innerHTML, a script string, an unsafe URL, or another executable context, or when an endpoint is served with a misleading media type or JSONP-style behavior. The API should emit correct media types and nosniff; every consuming UI must render data with safe, context-aware APIs.Interview-ready guide
Interview answer
A JSON-only API has a lower direct XSS risk because an application/json response is data and the browser does not normally execute strings inside it. A value such as
The vulnerability is created when a browser consumer sends that value to an executable sink. If a frontend assigns it to innerHTML, writes it into a script string, or builds an unsafe URL, the browser may interpret attacker data as code. Assigning the same value to textContent or normal framework text interpolation keeps it as data.
The API should return Content-Type: application/json, add X-Content-Type-Options: nosniff, avoid JSONP-style executable responses, and treat stored user data as untrusted. Each frontend must then use the correct sink and context-specific protection. The useful debugging question is: where does this value finally meet a browser parser?
XSS Cross-Site Scripting – Java Backend Security
Direct Answer
Returning JSON with Content-Type: application/json does not normally execute its strings, so a pure API response is not itself an HTML sink. XSS appears when a browser client later inserts an attacker-controlled JSON value into innerHTML, a script string, an unsafe URL, or another executable context, or when an endpoint is served with a misleading media type or JSONP-style behavior. The API should emit correct media types and nosniff; every consuming UI must render data with safe, context-aware APIs.
Check your understanding
Answer these without looking back at the article.
- What does X-Content-Type-Options: nosniff actually prevent?
- How can a single-page app reintroduce XSS even with a safe JSON API?
- Why does returning user data with the wrong Content-Type matter?
Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.