Cross-Site Scripting (XSS) in Helidon APIs typically manifests when untrusted input is reflected in the response body without strict Content-Type enforcement or proper output encoding. Even 'text/plain' can be dangerous if the browser performs MIME-sniffing. In a REST context, failing to sanitize data before returning it in a JSON payload or HTML error page allows attackers to inject malicious scripts that execute in the victim's browser context.

The Vulnerable Pattern

routing.get("/user", (req, res) -> {
    // VULNERABLE: Direct reflection of query parameter without encoding or strict type
    String username = req.query().first("name").orElse("guest");
    res.status(200).send("
Welcome, " + username + "
");
});
// Or via JSON reflection without proper headers:
routing.get(“/echo”, (req, res) -> {
String input = req.query().first(“input”).orElse("");
res.send(”{“result”: "" + input + ""}”); // Manual JSON string building is a recipe for disaster
});

The Secure Implementation

To mitigate XSS in Helidon, follow three core principles: 1. Avoid manual string concatenation for responses; use Helidon's JSON-P or JSON-B support to ensure values are properly escaped within the JSON structure. 2. Explicitly set the 'Content-Type' header to 'application/json' to prevent browsers from interpreting the response as HTML. 3. Always include the 'X-Content-Type-Options: nosniff' header to disable MIME-sniffing, which is a common vector for bypassing content-type restrictions. For HTML responses, use a dedicated templating engine with auto-escaping enabled or a library like OWASP Java HTML Sanitizer.

routing.get("/user", (req, res) -> {
    String username = req.query().first("name").orElse("guest");
    // SECURE: Use JSON Marshalling and enforce Content-Type
    JsonObject response = Json.createObjectBuilder()
        .add("message", "Welcome")
        .add("user", username)
        .build();
res.headers().add(HttpHeaderNames.CONTENT_TYPE, "application/json");
res.headers().add("X-Content-Type-Options", "nosniff");
res.send(response);
});