Cross-site scripting and ASP.NET

Question

Does an ASP.NET application protect against cross-site scripting by default? I have read that the machine.config file has an attribute that is set to on by default and this protects against cross-site scripting? Is this true?

by default you cannot submit a script like tag to an ASP.NET form, on MVC every output get HTML encoded before being printed to the client, so the answer is yes — AMember
– AMember, Commented Jul 6, 2013 at 13:18
Thanks :) That's what I wanted to hear :) So an ASP.NET application automatically protects against cross-site scripting by default? — Matthew
– Matthew, Commented Jul 6, 2013 at 13:19
xss is covered, csrf is not. You can try to create a simple form and test it yourself — AMember
– AMember, Commented Jul 6, 2013 at 13:22
Yes. In fact I tested it on a web application of mine and when I entered characters like "<>", an exception was raised. — Matthew
– Matthew, Commented Jul 6, 2013 at 13:23

qwr · Accepted Answer · 2013-07-06 13:20:07Z

1

<system.web>
  <pages buffer="true" validateRequest="true" />
</system.web>

you can use antxss library as addition

answered Jul 6, 2013 at 13:20

qwr

3,61419 silver badges29 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Matthew Over a year ago

Thanks :) That's the line I was talking about. That protects against cross-site scripting. Am I correct in saying that?

Erlend Over a year ago

That question has been asked many times before. The answer is "it depends on your app". See my answer here: stackoverflow.com/questions/9733427/…

Collectives™ on Stack Overflow

Cross-site scripting and ASP.NET

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related