ASP.NET Core 5 Secure Coding Cookbook

Chapter 8: Cross-Site Scripting

Cross-site scripting is still one of the widespread vulnerabilities in web applications today. Also known as XSS, it is a security flaw that allows an attacker to insert malicious client-side code into an ASP.NET Core web page. The injected input is made possible because of the lack of sanitization and filtering, and the browser processes the unwanted arbitrary code.

An unknowing user can view a vulnerable web page in an XSS attack where the malicious script runs in the browser. Once the code executes, the attacker can potentially redirect the user to a rogue website, potentially steal its session cookies, or deface your ASP.NET Core web application.

In this chapter, we're going to cover the following recipes: ...