Fix XSS in API Responses in Beego
Reflected XSS in Beego APIs occurs when untrusted input is echoed back into the response body without proper encoding or restrictive Content-Type headers. If an attacker can force the browser to interpret a JSON or plain text response as HTML, they can execute arbitrary JavaScript in the context of the user's session. This is common when using raw output methods like Ctx.WriteString instead of structured, type-safe response handlers.
The Vulnerable Pattern
func (c *MainController) Get() {
// VULNERABLE: User input 'name' is directly concatenated into the response.
// If a browser sniffs this as text/html,
The vulnerability exists because Ctx.WriteString does not explicitly set a secure Content-Type, potentially allowing MIME-sniffing. The fix leverages Beego's ServeJSON() method, which sets 'Content-Type: application/json; charset=utf-8'. Modern browsers do not execute scripts found in JSON payloads. Furthermore, when rendering HTML, always use the built-in Go 'html/template' engine via Beego's TplName, which provides context-aware escaping to neutralize malicious payloads like .
func (c *MainController) Get() {
// SECURE: Use ServeJSON to force 'application/json' Content-Type.
// This prevents the browser from interpreting the response as HTML.
name := c.GetString("name")
c.Data["json"] = map[string]string{"message": "Welcome", "user": name}
c.ServeJSON()
}
// ALTERNATIVE: If you must return HTML, use Beego’s template engine which handles auto-escaping.
// c.TplName = “user.tpl”
// c.Data[“Name”] = name
Your API Responses API
might be exposed to XSS
74% of API Responses apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.