Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are using IBM HTTP Server Version 7.0

Need help related to Cross Site Scripting Prevention in IBM http server.

Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in following link: https://blogs.oracle.com/meena/entry/cross_site_scripting_prevention_in

Is there any configuration setting related to IBM http server ?

How can we do entity encoding or filtering settings in ibm http server ?

share|improve this question
    
IBM have extensive documentation in the Redbook (redbooks.ibm.com) collection, have you read through it yet? –  Rory Alsop Mar 18 '13 at 10:27
    
@RoryAlsop No, There are lot of things-books. I dont know which 1 is best suitable for my problem? –  StackOverFlow Mar 18 '13 at 11:35
    
Did you looked at this link. ibm.com/developerworks/websphere/techjournal/1004_botzum/… –  Saladin Mar 19 '13 at 8:48
add comment

1 Answer

IBM Webserver is based upon Apache. Reading the Oracle article posted, it looks like they are talking about enabling entity encoding. I do not think the way that an apache based server works can blanketly tell about input since the programing language is not tightly couples to the web server. More or less what that article is saying is that that you replace < and > tags with the html entities so they will not be interpreted as code by the browser. Most likely you will want to implement this within your app code.

If you have not already been there, start your exploration of blocking XSS with the OWASP XSS Prevent Cheat Sheet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.