We have a .NET 4 web application with a few hidden form fields. When the site was tested for XSS vulnerabilities, these hidden fields were the first victims. How can we protect and safeguard our hidden fields? For normal textboxes and other fields, we use server side validation. But how do we check hidden fields to avoid XSS issues?
2 Answers
Hidden fields are only a client-side convention. On the server side you are just seeing strings of data. XSS protections should not vary whether it is a hidden field, drop down, or any other input field. Remember, it is possible to just send raw HTTP traffic to your server, a web browser just makes it pretty and easy to work with.
When the data is retrieved server side in either the GET or POST variables they are all going to be treated the same. So every field needs to be checked, in other words, all user provided input should be validated. Check out the OWASP general guidance and the .NET Security Guidance.
Depending on the specific setup on .NET you will need a custom validator as one technique.
You can protect your .Net web app by using Razor HTML and Javascript encoding In addition to this there is a quite cool library: .NET AntiXSS Library which is:
an encoding library which uses a safe list approach to encoding. It provides Html, XML, Url, Form, LDAP, CSS, JScript and VBScript encoding methods to allow you to avoid Cross Site Scripting attacks. This library is part of the Microsoft SDL tools.
-
The link to the "Razor HTML and Javascript encoding" doesn't work :(– SparrowCommented Jan 17, 2018 at 18:54
-
1
display: noneproperty or something similar, remember this can be changed using standard developer tools built into browser and therefore need to be treated as normal visible fields.