2

We have a .NET 4 web application with a few hidden form fields. When the site was tested for XSS vulnerabilities, these hidden fields were the first victims. How can we protect and safeguard our hidden fields? For normal textboxes and other fields, we use server side validation. But how do we check hidden fields to avoid XSS issues?

  • 2
    Hidden fields need to be validated at the server too. This question might help how to do this in asp.net. And there are many more hits when simple using a search engine with asp.net validate hidden field – Steffen Ullrich Jan 17 '18 at 8:12
  • 1
    If you hide them using display: none property or something similar, remember this can be changed using standard developer tools built into browser and therefore need to be treated as normal visible fields. – gonczor Jan 17 '18 at 9:00
1

Hidden fields are only a client-side convention. On the server side you are just seeing strings of data. XSS protections should not vary whether it is a hidden field, drop down, or any other input field. Remember, it is possible to just send raw HTTP traffic to your server, a web browser just makes it pretty and easy to work with.

When the data is retrieved server side in either the GET or POST variables they are all going to be treated the same. So every field needs to be checked, in other words, all user provided input should be validated. Check out the OWASP general guidance and the .NET Security Guidance.

Depending on the specific setup on .NET you will need a custom validator as one technique.

0

You can protect your .Net web app by using Razor HTML and Javascript encoding In addition to this there is a quite cool library: .NET AntiXSS Library which is:

an encoding library which uses a safe list approach to encoding. It provides Html, XML, Url, Form, LDAP, CSS, JScript and VBScript encoding methods to allow you to avoid Cross Site Scripting attacks. This library is part of the Microsoft SDL tools.

  • The link to the "Razor HTML and Javascript encoding" doesn't work :( – Sparrow Jan 17 '18 at 18:54
  • 1
    @Sparrow my bad link fixed ! – Soufiane Tahiri Jan 18 '18 at 10:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.