I use the same technique in my book to show how a REST API can be used to exploit XSS even it it always produces and consumes only valid JSON: https://livebook.

I use the same technique in my book to show how a REST API can be used to exploit XSS even it it always produces and consumes only valid JSON: https://livebook.manning.com/book/api-security-in-action/chapter-2/v-11/267 https://livebook.manning.com/book/api-security-in-action/cha...