Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using IBM HTTP Server Version 7.0

Need help related to Cross Site Scripting Prevention in IBM http server.

Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in following link:

Is there any configuration setting related to IBM http server ?

How can we do entity encoding or filtering settings in ibm http server ?

share|improve this question
IBM have extensive documentation in the Redbook ( collection, have you read through it yet? – Rory Alsop Mar 18 '13 at 10:27
@RoryAlsop No, There are lot of things-books. I dont know which 1 is best suitable for my problem? – StackOverFlow Mar 18 '13 at 11:35
Did you looked at this link.… – Saladin Mar 19 '13 at 8:48

IBM Webserver is based upon Apache. Reading the Oracle article posted, it looks like they are talking about enabling entity encoding. I do not think the way that an apache based server works can blanketly tell about input since the programing language is not tightly couples to the web server. More or less what that article is saying is that that you replace < and > tags with the html entities so they will not be interpreted as code by the browser. Most likely you will want to implement this within your app code.

If you have not already been there, start your exploration of blocking XSS with the OWASP XSS Prevent Cheat Sheet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.