# Endpoint with query parameter named callback

**URL:** <https://discourse.nodered.org/t/endpoint-with-query-parameter-named-callback/81606>\
**Category:** General\
**Created:** [27 September 2023 10:20 UTC](https://discourse.nodered.org/t/endpoint-with-query-parameter-named-callback/81606 "2023-09-27T10:20:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hxRedd](https://avatars.discourse-cdn.com/v4/letter/h/9de053/32.png) [@hxRedd](https://discourse.nodered.org/u/hxRedd)\
**Post date:** [27 September 2023 10:20 UTC](https://discourse.nodered.org/t/endpoint-with-query-parameter-named-callback/81606/1 "2023-09-27T10:20:28Z")

</div>

I'm currently migrating some old stuff to node-red. One of the legacy API that I'm migrating is simple like this:

Method: GET  
URL: /sampleendpoint

The response is a formatted JSON object like this:

```auto
{
    "type": "test",
    "success": true
}

```

The issue that I can't resolve is when the caller passes a query parameter named " **callback**". Node-red is adding some function inside the response payload that I'm returning as a final message. This only happens if the query parameter is named " **callback**".

Here's a sample curl to show the message I'm getting:

```auto
curl --location 'http://127.0.0.1:1880/sampleendpoint?callback=https%3A%2F%2Fgoogle.com'

```

The response I'm getting if I have this query parameter named "callback" is this:

```auto
/**/ typeof httpsgoogle.com === 'function' && httpsgoogle.com({"type":"test","success":true});

```

Is this a known bug? anything that I can do to turn this off?

---

<div class="post-metadata">

**Author:** ![E1cid](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/e1cid/32/77971_2.png) [@E1cid](https://discourse.nodered.org/u/E1cid)\
**Post date:** [27 September 2023 12:15 UTC](https://discourse.nodered.org/t/endpoint-with-query-parameter-named-callback/81606/2 "2023-09-27T12:15:30Z")

</div>

looks like a bug, I am sure the node maintainers will clarify if it is and is know . If it is I would raise an issue to the github repo.

You can work around it by using a change node to move `msg.req.query.callback` to another property maybe `msg.req.query._callback` before it gets to the response node.

---

<div class="post-metadata">

**Author:** ![hxRedd](https://avatars.discourse-cdn.com/v4/letter/h/9de053/32.png) [@hxRedd](https://discourse.nodered.org/u/hxRedd)\
**Post date:** [27 September 2023 13:19 UTC](https://discourse.nodered.org/t/endpoint-with-query-parameter-named-callback/81606/3 "2023-09-27T13:19:51Z")

</div>

I tried your suggestion and it actually worked! appreciate the suggestion, never thought of this kind of approach.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [11 October 2023 13:20 UTC](https://discourse.nodered.org/t/endpoint-with-query-parameter-named-callback/81606/4 "2023-10-11T13:20:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.