ASP.NET MVC 4 by default ignores HTML input in a post message. If I don't explicitly accept HTML, is there any code I need to write to defend my site against XSS attacks? I won't be using [AllowHtml] or [ValidateInput(false)]. I'm just trying to find out if I should worry about XSS attacks or not. I'm using Razor as my view engine.
Asked
Active
Viewed 1.1k times
13
Mark13426
- 2,569
- 6
- 41
- 75
-
A similar question was asked here: http://stackoverflow.com/questions/3955658/how-do-you-avoid-xss-vulnerabilities-in-asp-net-mvc – Ed Charbeneau Oct 02 '12 at 14:26
-
That's mentioning ASPX syntax. I'm using Razor. Also, I'm using the latest version of MVC. – Mark13426 Oct 02 '12 at 15:00
1 Answers
12
I found an excellent blog post by Amir Ismail that addresses all of your concerns. http://miroprocessordev.blogspot.com/2012/03/save-aspnet-mvc-application-against.html
To summarize what he writes.
Razor is encoded default unless Html.Raw is used.
Html.AntiForgeryToken() can be used to create a random token that will protect against CSRF however it requires the user to accept cookies.
Community
- 1
- 1
Ed Charbeneau
- 4,501
- 23
- 23