Building RESTful Web Services with .NET Core

Cross-site scripting attacks

Cross-site scripting attacks—or XSS attacks—typically happen as a result of bad input, where an attacker injects client scripts (JavaScript in most cases) into the web page. According to the official web page (https://docs.microsoft.com/en-us/aspnet/core/security/cross-site-scripting):

"Cross-Site Scripting (XSS) is a security vulnerability which enables an attacker to place client-side scripts (usually JavaScript) into web pages."

Here, I am using the example of a web client that consumes web services. You will learn more about web clients in Chapter 10, Building a Web Client (Consuming Web Services).

The following screenshot shows a scenario where the Create screen is under attack:

The preceding screenshot ...