Hi
I have a ASP.NET 2.0 website running on Windows 2003/IS 6.0.
I'm trying to secure my site against XSS attacks.
After reading up a bit on the articles on the .net/MSDN , I'm looking at output filtering as one of the preventive mesaures.
So the idea is to prevent any malicious script execution by encoding the HTTP output response by virtue of which the script gets renderd as plain text .
One of the options suggested was using the HttpUtility.HtmlEncode method to encode the output .
The following works perfectly fine and the script does get rendered as plain text on the browser :
Response.Write( HttpUtility.HtmlEncode (" <script> alert('Test' ); </script>" ));
However I wish to do the encoding in a centralised location rather than encoding every Response.Write in the application.
I tried to create a custom response filter ( fllowing the article on Go to the complete details ...