We are using IBM HTTP Server Version 7.0

Need help related to Cross Site Scripting Prevention in IBM http server.

Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in following link: https://blogs.oracle.com/meena/entry/cross_site_scripting_prevention_in

Is there any configuration setting related to IBM http server ?

How can we do entity encoding or filtering settings in ibm http server ?


IBM Webserver is based upon Apache. Reading the Oracle article posted, it looks like they are talking about enabling entity encoding. I do not think the way that an apache based server works can blanketly tell about input since the programing language is not tightly couples to the web server. More or less what that article is saying is that that you replace < and > tags with the html entities so they will not be interpreted as code by the browser. Most likely you will want to implement this within your app code.

If you have not already been there, start your exploration of blocking XSS with the OWASP XSS Prevent Cheat Sheet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.