Introduction
As REST APIs communicate primarily via JSON payloads, securing JSON serialization and parsing mechanisms is critical to preventing Cross-Site Scripting (XSS) and Denial of Service (DoS) vulnerabilities.
Critical Security Guidelines
1. Never Use eval() to Parse JSON
Legacy JavaScript applications sometimes used eval(). Never do this as it executes arbitrary JavaScript code.
❌ Dangerous: eval('(' + userInput + ')')
✅ Secure: JSON.parse(userInput)
2. Enforce Payload Size Limits
Unbound JSON request body limits allow malicious actors to send massive JSON payloads, consuming server RAM. Limit JSON request body size in middleware (e.g. express.json({ limit: '1mb' })).
3. Sanitize HTML Content Inside Strings
Ensure string values containing HTML entities are sanitized before rendering onto web pages.
For secure client-side JSON processing where zero data leaves your device, format payloads with JSON Workshop.