KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
I have a model and a form in the view. I have a simple field of string which is called description. I'm able to insert scripts like: <script>alert('xss')</script> to that field. I can see that in other actions on my site with other models I can't I do not have an AllowHtml or anything like that. the only difference is that for this model I use a post with a json object and content-type of application/json the ModelState.IsValid is returning true. even though there is a description property with an xss script on it... and for the other actions I make a simple ajax post. why isn't the validation input work on this kind of JSON ajax posts? how can I prevent xss across the entire site for this kind of ajax requests? thanks
Tags (comma-separated)
Save Edits
Cancel