ASP.NET Core MVC Interview Question #118
What is Cross-Site Scripting (XSS), and how does Razor help prevent it?
Authentication, Authorization, Security & State Management Mid-Level Intermediate
Quick Interview Answer
XSS occurs when untrusted content is rendered as executable HTML or JavaScript in another user's browser. Razor HTML-encodes ordinary string output by default, which significantly reduces the risk when displaying untrusted text.
Detailed Explanation
XSS occurs when untrusted content is rendered as executable HTML or JavaScript in another user's browser. Razor HTML-encodes ordinary string output by default, which significantly reduces the risk when displaying untrusted text.
Developers can reintroduce XSS by using Html.Raw with unsafe data, building unsafe JavaScript strings, or storing and rendering unsanitized HTML. Output encoding and contextual sanitization remain important.
Code Example
@* Encoded by Razor *@
<p>@Model.UserComment</p>
@* Avoid Html.Raw for untrusted content. *@