.net - Preventing XSS attacks across site -

i need review quite large .net 4.0 project , re-factor prevent xss attacks. first thing did turn on requestvalidation site, there else can @ global level or going case of trawling through every page, validating input , html encoding output.

there lots of pages, , 300 classic asp pages still in use.

is htmlencode() safe use or need install microsofts antixss package.

requestvalidation approach.

1. at global level 1 more thing can think of enabling x-xss-protection header @ http responses. easy implement , gives native defences browser (ie 8+, chrome) has offer based on xss patterns. x-xss-protection: 1; mode=block

2. you may @ content-security-policy, think in scenario may big roll out entire site.

those think of http header based xss mitigations. generic , not apply asp.net.

answering other question is htmlencode() safe use or need install microsofts antixss package what benefit make encodertype antixssencoder in mvc application?

antixssencoder uses whitelist approach identify malicious inputs [inputs result in cross site scripting (xss)].

the default encoder in asp.net uses blacklist approach.

both output encoding on data. security standpoint whitelist based approach should preferred on blacklist approach identifying malice.

excerpt http://weblogs.asp.net/jongalloway/using-antixss-4-1-beta-as-the-default-encoder-in-asp-net

1.antixss inherently more secure due using whitelist approach. many security audits , certifications require use whitelist xss encoder because blacklist potentially vulnerable unknown attacks.

2.newer browsers have better xss filtering built in, there vulnerabilities in older browser (e.g. utf-7 charset switch) wouldn't detected picked asp.net default encoder.