Currently, I have a website application where I am required to pass a JSON response (in string format) across the site. To achieve this, I have been using a hidden type value and passing it upon the submission of a link/button which subsequently triggers another page. However, during a check on Web Application Firewall (WAF), an error related to cross-site scripting was detected. Given that the response contains special characters, I suspect this may be the root cause of the issue. Now, my goal is to pass the JSON response in an encoded format and then decode it on the following webpage. I have researched various articles and posts on this topic, but would appreciate any suggestions for best practice implementations.
Here is an example of the code snippet:
<input type="hidden" name="empStatus" id="empStatus" value=""> //in JSP
$("#empStatus").val(JSON.stringify(empStatus)); //in JS