Skip to main content
Information Security

Return to Question

edited body
Source Link
mikemurf22
mikemurf22
  • 163
  • 5

A former employee, put the following in our "global.axas"

if (url.Contains("xss")){
response.StatusCode = 404;
resposneresponse.end();
}

I get he was trying to prevent cross site scripting, but other than example where people put alert('prevent xss');, what is the risk that he was trying to prevent?

The reason I'm asking is because we encrypt some data and the encrypted string contains the "...xss.." string, which is preventing the application from working as expected.

A former employee, put the following in our "global.axas"

if (url.Contains("xss")){
response.StatusCode = 404;
resposne.end();
}

I get he was trying to prevent cross site scripting, but other than example where people put alert('prevent xss');, what is the risk that he was trying to prevent?

The reason I'm asking is because we encrypt some data and the encrypted string contains the "...xss.." string, which is preventing the application from working as expected.

A former employee, put the following in our "global.axas"

if (url.Contains("xss")){
response.StatusCode = 404;
response.end();
}

I get he was trying to prevent cross site scripting, but other than example where people put alert('prevent xss');, what is the risk that he was trying to prevent?

The reason I'm asking is because we encrypt some data and the encrypted string contains the "...xss.." string, which is preventing the application from working as expected.

Tweeted twitter.com/StackSecurity/status/1157124164853096448
Source Link
mikemurf22
mikemurf22
  • 163
  • 5

Risk of allowing the string "xss" in query string

A former employee, put the following in our "global.axas"

if (url.Contains("xss")){
response.StatusCode = 404;
resposne.end();
}

I get he was trying to prevent cross site scripting, but other than example where people put alert('prevent xss');, what is the risk that he was trying to prevent?

The reason I'm asking is because we encrypt some data and the encrypted string contains the "...xss.." string, which is preventing the application from working as expected.