title: How to protect against XSS in ASP.NET Core?
body: <p>In ASP.NET we had Request Validation but in ASP.NET Core there is no such thing.</p>
  <p>How can we protect an ASP.NET Core app against XSS in the best way?</p>
  <p><strong>Request validation gone</strong>:
  <a href="https://nvisium.com/resources/blog/2017/08/08/dude-wheres-my-request-validation.html" rel="nofollow noreferrer">https://nvisium.com/resources/blog/2017/08/08/dude-wheres-my-request-validation.html</a></p>
  <ul>
  <li><p>this guy recommmends RegEx on <code>Models</code> like:</p>
  <p>[RegularExpression(@&quot;^[a-zA-Z0-9 -']*$&quot;, ErrorMessage = &quot;Invalid characters detected&quot;)]
  public string Name { get; set; }</p>
  </li>
  </ul>
  <p>...but that does not work for globalization/internationalization, i.e. non-latin characters like æ, ø å 汉字.</p>
  <p><strong>X-XSS to do &gt;limited&lt; XSS-protection</strong>: <a href="https://dotnetcoretutorials.com/2017/01/10/set-x-xss-protection-asp-net-core/" rel="nofollow noreferrer">https://dotnetcoretutorials.com/2017/01/10/set-x-xss-protection-asp-net-core/</a> Like this but there is only limited support afaik:</p>
  <pre><code>public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
      app.Use(async (context, next) =&gt;
      {
          context.Response.Headers.Add(&quot;X-Xss-Protection&quot;, &quot;1&quot;);
          await next();
      });
   
      app.UseMvc();
  }
  </code></pre>
  <p>The documentation from Microsoft is two years old: <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cross-site-scripting?view=aspnetcore-2.1" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/cross-site-scripting?view=aspnetcore-2.1</a> and does not really cover it.</p>
  <p>I am thinking to do something simple like:</p>
  <pre><code>myField = myField.Replace('&lt;','').Replace('&gt;','').Replace('&amp;','').Repl...;
  </code></pre>
  <ul>
  <li>on all data submission - but it seems kind of wonky.</li>
  </ul>
  <p>I have asked the same question for Microsoft but I am interested to hear how people are solving this problem in real-life applications.</p>
  <p><strong>Update: what we are trying to accomplish:</strong></p>
  <p>In our application, we have webforms where people can input names, email, content and similar. The data is stored in a database and will be viewed on a frontend system and possibly other systems in the future (like RSS feeds, JSON, whatever). Some forms contain rich-text editors (TinyMCE) and allow users to markup their texts. Malicious users could enter <code>&lt;script&gt;alert('evil stuff');&lt;/script&gt;</code> in the fields. What is the best way to strip the evil characters in ASP.NET Core before it reaches the database - I prefer evil scripts not to be stored in the database at all.</p>
  <p>I figured something like this could work:</p>
  <pre><code>const string RegExInvalidCharacters = @&quot;[^&amp;&lt;&gt;\&quot;&quot;'/]*$&quot;;
  
  [RegularExpression(RegExInvalidCharacters, ErrorMessage = &quot;InvalidCharacters&quot;)]
  public string Name { get; set; }
  
  [RegularExpression(RegExInvalidCharacters, ErrorMessage = &quot;InvalidCharacters&quot;)]
  public string Content { get; set; }
  
  ...
  </code></pre>