Home/ Questions/Q 6228835
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T09:27:26+00:00

From what I understand about what ASP.NET does and my own personal testing of

  • 0

From what I understand about what ASP.NET does and my own personal testing of various XSS tests, I found that my ASP.NET 4 website does not require any XSS prevention.

Do you think that an ASP.NET 4.0 website needs any added XSS security than its default options? I cannot enter any javascript or any tags into my text fields that are then immediately printed onto the page.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Disclaimer – this is based on a very paranoid definition of what “trusted output” is, but when it comes to web security, I don’t think you CAN be too paranoid.

    Taken from the OWASP page linked to below: Untrusted data is most
    often data that comes from the HTTP request, in the form of URL
    parameters, form fields, headers, or cookies. But data that comes from
    databases, web services, and other sources is frequently untrusted
    from a security perspective. That is, it might not have been perfectly
    validated.

    In most cases, you do need more protection if you are taking input from ANY source and outputting it to HTML. This includes data retrieved from files, databases, etc – much more than just your textboxes. You could have a website that is perfectly locked down and have someone go directly to the database via another tool and be able to insert malicious script.

    Even if you’re taking data from a database where only a trusted user is able to enter the data, you never know if that trusted user will inadvertently copy and paste in some malicious script from a website.

    Unless you absolutely positively trust any data that will be output on your website and there is no possible way for a script to inadvertently (or maliciously in case of an attacker or disgruntled employee) put dangerous data into the system, you should sanitize all output.

    If you haven’t already, familiarize yourself with the info here: https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

    and go through the other known threats on the site as well.

    In case you miss it, the Microsoft.AntiXss library is a very good tool to have at your disposal. In addition to a better version of the HtmlEncode function, it also has nice features like GetSafeHtmlFragment() for when you WANT to include untrusted HTML in your output and have it sanitized. This article shows proper usage: http://msdn.microsoft.com/en-us/library/aa973813.aspx The article is old, but still relevant.

    • 0