{"action":"closed","issue":{"url":"https://api.github.com/repos/expressjs/express/issues/2921","repository_url":"https://api.github.com/repos/expressjs/express","labels_url":"https://api.github.com/repos/expressjs/express/issues/2921/labels{/name}","comments_url":"https://api.github.com/repos/expressjs/express/issues/2921/comments","events_url":"https://api.github.com/repos/expressjs/express/issues/2921/events","html_url":"https://github.com/expressjs/express/issues/2921","id":137906020,"number":2921,"title":"Charset UTF-8 appended to Content-Type when using res.json","user":{"login":"emilssolmanis","id":663720,"avatar_url":"https://avatars.githubusercontent.com/u/663720?v=3","gravatar_id":"","url":"https://api.github.com/users/emilssolmanis","html_url":"https://github.com/emilssolmanis","followers_url":"https://api.github.com/users/emilssolmanis/followers","following_url":"https://api.github.com/users/emilssolmanis/following{/other_user}","gists_url":"https://api.github.com/users/emilssolmanis/gists{/gist_id}","starred_url":"https://api.github.com/users/emilssolmanis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/emilssolmanis/subscriptions","organizations_url":"https://api.github.com/users/emilssolmanis/orgs","repos_url":"https://api.github.com/users/emilssolmanis/repos","events_url":"https://api.github.com/users/emilssolmanis/events{/privacy}","received_events_url":"https://api.github.com/users/emilssolmanis/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-02T15:31:10Z","updated_at":"2016-03-02T18:22:56Z","closed_at":"2016-03-02T18:22:56Z","body":"Yes, I have read the CVE reasons on the [couple of issues](https://github.com/expressjs/express/issues/2713).\r\n\r\nThat would be valid for when strings are output, i.e., rendered templates and whatnot. However, if I'm sending a response via `res.json`, that should imply there is no browser involved in the mix, hence \"protecting\" me from XSS attacks is silly. The encoding should only be set when sending things intended for browser consumption, not when I've obviously written an API."}}