Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Does ASP.NET MVC 4 require extra XSS handling by default

ASP.NET MVC 4 by default ignores HTML input in a post message. If I don't explicitly accept HTML, is there any code I need to write to defend my site against XSS attacks? I won't be using [AllowHtml] or [ValidateInput(false)]. I'm just trying to find out if I should worry about XSS attacks or not. I'm using Razor as my view engine.

like image 580
Mark13426 Avatar asked Oct 02 '12 14:10

Mark13426


1 Answers

I found an excellent blog post by Amir Ismail that addresses all of your concerns. http://miroprocessordev.blogspot.com/2012/03/save-aspnet-mvc-application-against.html

To summarize what he writes. Razor is encoded default unless Html.Raw is used. Html.AntiForgeryToken() can be used to create a random token that will protect against CSRF however it requires the user to accept cookies.

like image 53
Ed Charbeneau Avatar answered Oct 11 '22 11:10

Ed Charbeneau