What does OWASP mean when they say you should not "send raw responses to clients"?

user_9339516 0
Viewed 108
  • Do not send raw responses to clients

https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/

What does this refer to? I tried to google, but all I can find is 'raw' as in the full text or stringified. Aren't all HTTP(s) responses 'raw' in this sense, since it's text based?

Or does it mean editing the response to give fake values regarding the server, rather than genuine ones?

owasp express security
1 Answers

I am fairly certain that it means you shouldn't send a response you received from a third party (e.g. an API) directly to the end user.

If you do so it could provide sensitive information to an attacker, or information that could further expose your app.

user_20849840
Related