Irrelevant to web API? (original) (raw)

Hi.
This security concern is irrelevant to web API right? That's why it is titled as "Prevent Cross-Site Scripting (XSS) in ASP.NET Core", i.e. web API is not mentioned at all and I guess this is also why the example solutions refer to razor pages, right? In other words, the problem applies to MVC because it builds the pages it serves.

In my understanding, a RESTful web API's response type is typically application/json, so it only declares that it correctly returns json, not web pages. Besides, the API's clients might not even be browsers at all. In other words, it's client agnostic.

And I think this is why I have observed that web API clients that are web pages like SPA libraries, single page applications, take care to properly html encode the content they need to present themselves.

Is this right? The topic is a little vaguely covered in the web.

Thank you.

Λεπτομέρειες εγγράφου

⚠ Μην επεξεργαστείτε αυτή την ενότητα. Απαιτείται για σύνδεση θεμάτων learn.microsoft.com ➟ GitHub.

Associated WorkItem - 82759