Prevent Cross-Site Script Inclusion (XSSI) in Symfony

Cross-Site Script Inclusion (XSSI) is a lesser-known web vulnerability that can expose sensitive application data. In Symfony applications, improper handling of JSON or JavaScript endpoints can allow attackers to bypass Same-Origin Policy and steal private data.

If you run a Symfony-powered application, you need to be aware of XSSI and how to mitigate it — before attackers exploit it.

---

What is XSSI?

XSSI exploits JavaScript or JSON responses that can be included in <script> tags from other domains. If your API or route returns JavaScript/JSON without proper safeguards, an attacker could load it in their site and read sensitive variables.

---

Example: Vulnerable Symfony Endpoint

// src/Controller/UserController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;

class UserController extends AbstractController
{
    public function profile()
    {
        $userData = [
            'username' => 'john_doe',
            'email' => 'john@example.com',
            'role' => 'admin'
        ];

        return new JsonResponse($userData);
    }
}

If /profile returns JSON without authentication or token checks, an attacker could do:

<script src="https://victim.com/profile"></script>

And then steal the embedded data.

---

How to Prevent XSSI in Symfony

1. Always Authenticate Requests

   $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY');
   

2. Use application/json Content-Type
   Ensure responses aren’t served with application/javascript.

3. Add Anti-XSSI Prefix

   return new JsonResponse(")]}',\n" . json_encode($data), 200, [], true);
   

4. Use CSRF Tokens for Sensitive Endpoints

---

Secure Coding Example

public function secureProfile()
{
    $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY');

    $user = $this->getUser();
    $data = [
        'username' => $user->getUsername(),
        'role' => $user->getRoles()
    ];

    return new JsonResponse(
        ")]}',\n" . json_encode($data),
        JsonResponse::HTTP_OK,
        ['Content-Type' => 'application/json']
    );
}

---

Test Your Website for XSSI and Other Vulnerabilities

We offer a Free Website Vulnerability Scanner to scan your site for vulnerabilities, including XSSI, XSS, SQL Injection, and more.

📷 Screenshot of the Website Vulnerability Scanner tool page:

Screenshot of the free tools webpage where you can access security assessment tools.

📷 Sample vulnerability report to check Website Vulnerability:

Sample vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.

👉 Try it here: https://free.pentesttesting.com/

---

More Cybersecurity Insights

Visit our blog for more security tips and guides:
https://www.pentesttesting.com/blog/

---

Our Specialized Services

1. Managed IT Services

Full IT infrastructure management for businesses.
🔗 Learn More

2. AI Application Cybersecurity

Protect AI-driven applications from unique threats.
🔗 Learn More

3. Offer Cybersecurity Services to Your Clients

Expand your business by reselling our cybersecurity expertise.
🔗 Learn More

---

Stay Updated

📩 Subscribe to our newsletter on LinkedIn:
Subscribe on LinkedIn

---

If you’re using Symfony, don’t let XSSI slip under your radar. Secure your endpoints, test regularly, and stay proactive in cybersecurity.