Fixing reflected XSS

Reflected cross-site scripting is one type of XSS where a bad actor could inject code as part of the HTTP response. The reflected XSS is non-persistent and not stored in the database, but the attack payload is delivered back to the browser, reflecting the untrusted input.

The reflected XSS vulnerability is possible when output is not encoded and exploited when tricked users click a malicious link containing the XSS payload. In this recipe, we will fix the reflected XSS vulnerability by using the built-in encoding features of the Razor page.

Getting ready

For the recipes in this chapter, we will need the sample Online Banking app.

Open the command shell and download the sample Online Banking app by cloning the ASP.NET Secure Coding Cookbook repository as follows:

git clone https://github.com/PacktPublishing/ASP.NET-Core-Secure-Coding-Cookbook.git

Run the sample app to verify that there are no build or compile errors. In your command shell, navigate...