I have been reading up on Anti-XSS Security Runtime Engine and it looks like a nice solution for web forms because it inspects controls via reflection and automatically encodes data where appropriate. However as I don't really use server side controls in ASP.NET MVC, it does not seem to be a viable solution for ASP.NET MVC. Is this correct or am I missing something?
Phil Haack has an interesting blog post here http://haacked.com/archive/2009/02/07/take-charge-of-your-security.aspx. He suggests using Anti-XSS combined with CAT.NET.
The Anti-XSS Security Runtime Engine is an HTTP Module primarily designed around updating legacy ASP.NET applications. If you've already written the ASP.NET MVC application with proper data cleansing with the built in HTML Helpers (i.e. Html.Encode()), then the Anti-XSS Engine adds nothing new, and requires additional configuration (for necessary white-lists) and error checking.
All in all, you should not rely on the Anti-XSS Engine, especially if you rely on explicit control of when input is and is not rendered as HTML.
AntiXSS's encoding differs from the .NET encoders in that we use safe lists, rather than unsafe lists to decide which characters need to be turned into their hex equivalents and which don't. This has a performance cost, but is inherently safer. So there is an advantage to using those encoding routines.
The security runtime is a different beast, it's a simple application firewall which looks for common attacks. Parts of it are web forms specific, parts work with both webforms and MV - blowdart 2010-07-15 01:59
