Improving Web Application Security: Threats and - CGISecurity

274 Part III: Building Secure Web ApplicationsDefense in Depth CountermeasuresIn addition to the techniques discussed earlier, use the following countermeasures fordefense in depth to prevent XSS:● Set the correct character encoding.●●●●●Use the ASP.NET version 1.1 validateRequest option.Install URLScan on your Web server.Use the HttpOnly cookie option.Use the security attribute.Use the innerText property.Set the Correct Character EncodingTo successfully restrict what data is valid for your Web pages, it is important to limitthe ways in which the input data can be represented. This prevents malicious usersfrom using canonicalization and multi-byte escape sequences to trick your inputvalidation routines.ASP.NET allows you to specify the character set at the page level or at the applicationlevel by using the element in Web.config. Both approaches areshown below using the ISO-8859-1 character encoding, which is the default in earlyversions of HTML and HTTP.To set the character encoding at the page level, use the element or theResponseEncoding page-level attribute as follows:ORTo set the character encoding in Web.config, use the following configuration: