# Is the HTML report my backend generates a security risk?

Yes, if you drop user input into it raw. This is the same family as front-end script injection, just on the server side - and it is easy to miss because most XSS advice is aimed at frontends.

**The shape.** Your backend turns user input into a web page and serves it back: a report, a chart page, an analysis tearsheet. Whatever the user typed - a stock symbol, a label, a name - gets printed inside that page. Put it in raw, and a visitor can supply a value that is **not really a label but a hidden instruction**, which the browser then runs as code **on your web address**. That smuggled code can read the visitor's login session, change what the page shows, or send them to a fake login screen. The risk is *any* user value that lands inside HTML you hand back.

**Two cheap defenses, used together.** First, **escape** the user's text before placing it in the page, so characters like ` ` become harmless symbols instead of the start of a tag (in Python, `html.escape()`). Second, attach two response headers that tell the browser to be strict: a **Content-Security-Policy** (which sources of scripts, styles and images may even run) and **X-Content-Type-Options: nosniff** (do not guess a file is something other than what you said). Together they mean that even if a bad value slips past the escaping, the browser refuses to run the injected script.

**The coverage gap to watch:** apply those headers to *every* report page your backend serves - both files served out of a `/static` folder and any HTML you return directly. It is easy to add the middleware and still leave the static path bare.

Full item with the middleware: [https://www.tigzig.com/security/backend](https://www.tigzig.com/security/backend).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/is-the-html-report-my-backend-generates-a-security-risk
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms