Should I use the Anti-XSS Security Runtime Engine in ASP.NET MVC?

Go To StackoverFlow.com

15

I have been reading up on Anti-XSS Security Runtime Engine and it looks like a nice solution for web forms because it inspects controls via reflection and automatically encodes data where appropriate. However as I don't really use server side controls in ASP.NET MVC, it does not seem to be a viable solution for ASP.NET MVC. Is this correct or am I missing something?

2009-06-16 20:16
by Blegger
Interesting question- we had some security consultants rave about this the other day at work. I'd be interested in finding people's adoption of it - RichardOD 2009-06-16 20:22


3

Phil Haack has an interesting blog post here http://haacked.com/archive/2009/02/07/take-charge-of-your-security.aspx. He suggests using Anti-XSS combined with CAT.NET.

2009-06-18 11:57
by RichardOD
Reading this article pretty much re-affirms my understanding of lack of server side controls in ASP.NET MVC. "With MVC, we’ve swapped server controls with our helper methods, which properly encode output - Blegger 2009-06-18 15:19
Updated link to Haack's blog entry - patridge 2010-05-17 13:56


8

The Anti-XSS Security Runtime Engine is an HTTP Module primarily designed around updating legacy ASP.NET applications. If you've already written the ASP.NET MVC application with proper data cleansing with the built in HTML Helpers (i.e. Html.Encode()), then the Anti-XSS Engine adds nothing new, and requires additional configuration (for necessary white-lists) and error checking.

All in all, you should not rely on the Anti-XSS Engine, especially if you rely on explicit control of when input is and is not rendered as HTML.

2009-06-18 07:53
by Jon
Kind of - I own AntiXss and the SRE and whilst they're part of the same project they're not the same thing.

AntiXSS's encoding differs from the .NET encoders in that we use safe lists, rather than unsafe lists to decide which characters need to be turned into their hex equivalents and which don't. This has a performance cost, but is inherently safer. So there is an advantage to using those encoding routines.

The security runtime is a different beast, it's a simple application firewall which looks for common attacks. Parts of it are web forms specific, parts work with both webforms and MV - blowdart 2010-07-15 01:59

Ads