So, I found a website that uses AES encryption to prevent XSS and I'm wondering if this approach is inherently flawed.
It has an endpoint like
... <script>decryptedPayload</script> ....
The reasoning of the developer behind this is that only the page owner can craft valid encrypted Payloads, thus noone can forge malicious payloads.
I'm pretty sure the Key used is fixed.
Not sure about the IV - so far I only got one. But even if the IV is random, the payload usually is also fixed.
This seems wrong to me. Is it?
Edit: assumed CBC before but I noticed only part in the middle changes, so ECB