xssantixsslibrary

How to handle AntiXSSLibrary Globaly in asp.net application?


I want to prevent XSS attack in javascript using AntiXSSLibrary globally. Not able to find it in google. Kindly help. thanks in advance.


Solution

  • If by globally you mean something like "I want to write a few lines of code and solve it once and for all", that's not possible. If it was, XSS would not be one of the most prevalent vulnerabilities in web applications. :)

    To prevent XSS, you have to context-sensitively encode all dynamic output of your application, one by one, be it from the server to html (the page dom), or from javascript to the page dom.

    Specifically for javascript encoding, AntiXSSLibrary provides JavaScriptEncode() which you can use to encode javascript strings. (Also note it's second parameter that allows you to omit the automatic quotes - it can make your code look nicer and easier to analyse.)