5

Does Sitecore have an inbuilt mechanism to prevent DOM XSS

A user should not be able to run

http://{url}/#<>Script>

from the browser

what is the best practice to handle such scenarios? This cannot be handled on the server as text after '#' would not be passed onto the server

I have read about handling XSS attacks server side

https://www.akshaysura.com/2016/08/18/secure-sitecore-cross-site-scripting-xss-vulnerability-prevention/

  • 1
    Unless you are using SXA or talking about the CMS admin section, Sitecore does not handle anything on the frontend, you are responsible for implementing best practices to prevent DOM XSS. – jammykam Mar 7 '18 at 15:14
  • @jammykam : thanks for the reply , is there anything that we can do in javascript or jQuery to stop the request from hitting the server ? , any suggestions ? – SitecoreNoob Mar 7 '18 at 15:37
2

You can block those type of request directly from the router. To be able to do this, you will need to set it on WAF - Web Application Firewall.

A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. A WAF is differentiated from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers. By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, cross-site scripting (XSS), file inclusion, and security misconfigurations

More information can be found here

On WAF, you can also add exception whereby you can allow some type of url which contains js script but this is not recommended.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.