ASP.NET Core Interview Question #145
What is XSS and how can ASP.NET Core applications reduce the risk?
Authentication, Authorization & Security Mid-Level Intermediate
Quick Interview Answer
Cross-Site Scripting (XSS) occurs when untrusted data is rendered as executable browser content, typically JavaScript or malicious HTML. Razor normally HTML-encodes output, which is an important default defense.
Detailed Explanation
Cross-Site Scripting (XSS) occurs when untrusted data is rendered as executable browser content, typically JavaScript or malicious HTML. Razor normally HTML-encodes output, which is an important default defense.
Developers should avoid rendering untrusted input with Html.Raw, validate or sanitize HTML when the application intentionally accepts markup, and use appropriate browser security headers such as Content-Security-Policy as defense in depth.
Encoding must match the output context; HTML, JavaScript, URLs, and attributes have different security considerations.
Code Example
@* Razor encodes this by default *@
<div>@Model.DisplayName</div>
@* Avoid for untrusted user content: *@
@* @Html.Raw(Model.UserSuppliedHtml) *@