Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When i use method Get and intercept the request with any proxy tool. then Cross site scripting because of absence of server side validations. But in case of post method, as we know data flows in the body of the request and when i intercept any body parameter with the script, then again XSS executes.

I want to know do i need to do server side validations on each screen or is their any global thing which can save me from XSS. I am using Java J2

share|improve this question

closed as unclear what you're asking by Xander, Noordung, NULLZ, Adnan, Terry Chia Nov 27 '13 at 9:24

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Can you edit your answer to be more specific about what you are using? J2 probably means J2EE, but that could still mean many different things. –  mcgyver5 Nov 25 '13 at 18:15
    
Yes..i am using servlets and hibernates too. Its basically a portal. –  Ayush3g Nov 25 '13 at 18:37
    
Please read the How to Ask page to understand what we need from questions. So far all of yours have been closed, so please take a couple of minutes to look at the guidance. –  Rory Alsop Nov 28 '13 at 7:43

2 Answers 2

The OWASP cheat sheet has a number of suggestions for mitigating XSS attacks.

If you already have a framework you are using (e.g., Spring or Struts), they might have some protection mechanisms that can be configured.

If you are looking for an add-on framework, consider OWASP ESAPI or the OWASP Java Encoder Project.

share|improve this answer

Get and Post are just the methods used by HTTP to send data to the server. Generally XSS is observed when untrusted data received from the client is reflected by the server without sanitization. This is independent of using get or post.

Untrusted data is the data coming from the client side which can be modified by the client ( this includes hidden fields and HTTP header fields).

Server side validation is a good first line of defense against XSS and since you are using java you may want to write a filter which performs validations for all the requests. The best way of protecting against XSS is the use of encoding. These links may help

XSS intro

Cheatsheet

HTML encoding to protect against XSS

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.