Which set of security API methods could be used as the best defense against Cross Site Scripting?
-
Input Validation and OutPut Encoding
-
Authentication and Authorization
-
Data Protection and Cryptography
-
HTTP and Communication Security
Cross Site Scripting (XSS) attacks inject malicious scripts into web pages viewed by other users. The most effective defense combines input validation (rejecting malicious input) and output encoding (converting special characters to HTML entities). Authentication and cryptography protect against different threats, not XSS.
Cross-site scripting (XSS) happens when untrusted input is rendered back into a page and interpreted as executable script or markup. The two-pronged defense is validating input against a strict expected format (rejecting or stripping anything that doesn't conform) and encoding output for the context it's placed in (HTML entity encoding, JS-string encoding, URL encoding, etc.) so any special characters are rendered inert. Authentication/authorization and cryptography address different threats (identity and confidentiality/integrity), not injection of scripts into rendered content.