CASE .NET (312-95) · 4.3 — Defensive Coding Against Cross-Site Scripting (XSS)

How cross-site scripting works (reflected, stored, DOM-based), and defensive coding in ASP.NET: context-aware output encoding, Razor automatic encoding and Html.Raw, Web Forms encoding syntax, HtmlEncoder / JavaScriptEncoder / UrlEncoder in ASP.NET Core, sanitising rich text, request validation, HttpOnly cookies and Content Security Policy. Five practice questions included.

Chapters:
00: 00 Introduction
00: 21 How XSS works
01: 57 Primary defence: output encoding
04: 06 Additional layers
05: 25 Practice questions

Domain 4: Secure Coding Practices for Input Validation
Unofficial revision material. Not affiliated with or endorsed by EC-Council.

▶ Full CASE .NET course, all videos in order: https://www.youtube.com/playlist?list=PLWot0r-SeHlw
▶ More from this domain: https://www.youtube.com/playlist?list=PLA2WMQYUb2Hg
Playlist: CASE .NET · Domain 4 — Secure Coding Practices for Input Validation
Channel: Tosin Omojola · Cloud Security Lab
Narration uses a synthetic (text-to-speech) voice; slides and scripts prepared for exam revision.

#AppSec #SecureCoding #DotNet