I am trying to implement anti XSS support in a web forms app running on .net 4.5 but I am a little confused. I want to sanitise data on input and encode data on output. My understanding is that, out of the box, the default input filtering in the .net framework
uses a black list, but that a white list approach is more favourable.
I’ve read that using the Microsoft AntiXSS / Web protection Library is the recommended approach, however I’m unsure as to what’s involved with implementing it. I’ve read numerous articles on the subject and some imply that by merely including an entry in your
config file will replace the default filtering/encoding with the more robust AntiXSS version, meaning the enhanced filtering/encoding is then done automatically. Is this true and if so, is there an easy way to test it to prove the new library is being used?
Go to the complete details ...