While using Ajax in web applications we use XML to transfer the data between server and client. However XSS validation comes into picture, So questions are, 1. Is passing XML like this is correct? 2. Are we exposed to security issues if we turn off XSS validation? 3. Can passing Ajax request with header (content-type = application/xml) solve this problem ?
JSON is also good approach to transfer the data but that to invoke XSS. So what is correct and incorrect? Suggest some good practices. Please provide your input for the same. Thanks,