Click here to Skip to main content
16,017,373 members
Articles / Web Development / ASP.NET

Preventing XSS Attacks in ASP.NET MVC using ValidateInput and AllowHTML

Rate me:
Please Sign up or sign in to vote.
5.00/5 (4 votes)
28 May 2015CPOL3 min read 78.8K   3   4
In this blog we will try to understand how we can prevent and fine tune XSS(Cross Site Security) security attacks in ASP.NET MVC.

Introduction

What is XSS?

How can we prevent the same in MVC?

What is the difference between “ValidateInput” and “AllowHTML” in MVC ?

Introduction

In this blog we will try to understand how we can prevent and fine tune XSS(Cross Site Security) security attacks in ASP.NET MVC.

What is XSS?

XSS(Cross Site Security) is a security attack where the attacker injects malicious code while doing data entry. This code can be a javascript, vbscript or any other scripting code. Once the code is injected in end user’s browser. This code can run and gain access to cookies,sessions, local files and so on.

For instance below is a simple product data entry form. You can see in the product description how the attacker has injected a javascript code.

Image 1

Once we click submit you can see the JavaScript code actually running.

Image 2

How can we prevent the same in MVC?

In MVC by default XSS attack is validated. So if any one tries to post javascript or HTML code he lands with the below error.

Image 3

What is the difference between “ValidateInput” and “AllowHTML” in MVC?

As said in the previous question in ASP.NET MVC we are not allowed to post scripts and HTML code by default. But consider the below situation where we want HTML to be written and submitted.

The other scenario where we need HTML to be posted is HTML editors. So there is always a need now and then to post HTML to the server.

Image 4

So for those kinds of scenarios where we want HTML to be posted we can decorate the action with “ValidateInput” set to false.This by passes the HTML and Script tag checks for that action.

You can see in the below code we have requested the MVC framework to NOT VALIDATE the input to the action.

lang
[ValidateInput(false)]
public ActionResult PostProduct(Product obj)
{
return View(obj);
} 

But the above solution is not proper and neat. It opens a complete Pandora box of security issues. In this product screen scenario we just HTML in product description and not in product name.

But because we have now decorated validate false at the action level , you can also write HTML in product name field as well. We would love to have more finer control on the field level rather than making the complete action naked.

Image 5

That’s where “AllowHTML” comes to help. You can see in the below code we have just decorated the “ProductDescription” property .

HTML
public class Product
{
        public string ProductName { get; set; }
        [AllowHtml]
        public string ProductDescription { get; set; }
}

And from the action we have removed “ValidateInput” attribute.

HTML
public ActionResult PostProduct(Product obj)
{
            return View(obj);
}

If you now try to post HTML in product name field you will get the below error saying you cannot post HTML tags in product name field.

Image 6

So the difference between ValidateInput and AllowHTML is the granularity of preventing XSS attacks.

Hope you have enjoyed this blog.

Also the other dead attack which happens on a MVC website is CSRF, see the below facebook video which demonstrates how CSRF attack can be prevented.

Image 7

For further reading do watch the below interview preparation videos and step by step video series.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Architect https://www.questpond.com
India India

Comments and Discussions

 
QuestionPreventing XSS Attacks in ASP.NET MVC using ValidateInput and AllowHTML Pin
Divyang Desai13-Nov-16 19:21
Divyang Desai13-Nov-16 19:21 
QuestionHow do i prevent XSS in web api and angular? Pin
Member 1191277413-Sep-16 5:24
Member 1191277413-Sep-16 5:24 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.