We have a .NET 4 web application with a few hidden form fields. When the site was tested for XSS vulnerabilities, these hidden fields were the first victims. How can we protect and safeguard our hidden fields? For normal textboxes and other fields, we use server side validation. But how do we check hidden fields to avoid XSS issues?
Hidden fields are only a client-side convention. On the server side you are just seeing strings of data. XSS protections should not vary whether it is a hidden field, drop down, or any other input field. Remember, it is possible to just send raw HTTP traffic to your server, a web browser just makes it pretty and easy to work with.
When the data is retrieved server side in either the GET or POST variables they are all going to be treated the same. So every field needs to be checked, in other words, all user provided input should be validated. Check out the OWASP general guidance and the .NET Security Guidance.
Depending on the specific setup on .NET you will need a custom validator as one technique.
an encoding library which uses a safe list approach to encoding. It provides Html, XML, Url, Form, LDAP, CSS, JScript and VBScript encoding methods to allow you to avoid Cross Site Scripting attacks. This library is part of the Microsoft SDL tools.