config.active_support.escape_html_entities_in_json
is enabled by deafult in Rails (v4, v5) and it protects from some XSS attacks by encoding HTML entities <
, >
, &
and it's great for views (html)
But I think this encoding is redundant in API responses:
render status: :ok, json: { link: 'https://example.com?p1=v1&p2=v2' }
I expect to get:
{ link: 'https://example.com?p1=v1&p2=v2' }
instead of
{ link: 'https://example.com?p1=v1\u0026p2=v2' }
How to disable escaping HTML entities in JSON for API, but leave it enabled for views?
Thank you