My question is- why don't we store what ever is going to server as parameters and if these parameters are reflected in HTML response then discard it or encoded it
Any parameters? So if I search for “Hello” and the response page contains the text “Here are your results for Hello”, it gets mangled?
There has to be some criterion for what counts as potentially dangerous, otherwise every form on the web is going to break like this. You could start out with “any parameter with a
< in”, but then what about attribute injection attacks like
'; alert(document.cookie)? And how do you stop a parameter of just
< from breaking every tag on the page? There isn't an obvious watertight answer, which is why detection ends up being a complex mess of heuristic rules and not a clean, watertight pattern.
Personally I think client-side reflected-XSS detection is deeply misguided: in principle doomed to failure and in practice worse than useless, but if you're going to do it you'll need to limit its scope because content reflection is a common property the web needs to work properly, not always an attack.