I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques.

My question is- why don't we store what ever is going to server as parameters and if these parameters are reflected in HTML response then discard it or encoded it. Simple idea. I feel there may be false positives but not very convincing ones. Any input?


this approach is already found in various frameworks and works (more or less) against basic attack-patterns.

another, more elegant way is to use CSP, but you have some requirements when using this approach (no inline js/styles etc)

the problem is, from defender-pov, an attacker might have other points), nasty stuff like encoding, nullbytes and different ways to mitigate protection. if it were just ASCII, the world would be ( a little more) perfect :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.