When a user attempts to access any URL without authentication (including a non-existent URL), my web service returns an HTTP 401 response. This response is JSON encoded, and the body of this response contains the path requested by the user, presumably for diagnostic purposes.
The response also includes the `www-authenticate` header. If a user visits this URL in the browser, this triggers their browser to ask for credentials.

However, automated scanning tools report that this is an XSS vulnerability. This appears to be because the requested path is included, and if the requested path also happens to be valid JavaScript, this path is returned along with the response. See cURL output below:

```
curl -i  'https://myservice.example.com/<script>alert(1)</script>'
HTTP/2 401
server: nginx
date: Tue, 19 May 2020 15:02:20 GMT
content-type: application/json;charset=UTF-8
content-length: 167
strict-transport-security: max-age=31536000 ; includeSubDomains
www-authenticate: Basic realm="Spring"

{"timestamp":1589900540080,"status":401,"error":"Unauthorized","message":"Full authentication is required to access this resource","path":"/<script>alert(1)</script>"}%

```

I think that this is a false positive, as the API response is JSON encoded, as per this question: [Reflected XSS via JSON executed with Burp, but how to do it in realistic conditions?](https://security.stackexchange.com/questions/150009/reflected-xss-via-json-executed-with-burp-but-how-to-do-it-in-realistic-conditi)

Am I correct?