Anti-Cross Site Scripting Library

Cross-site scripting (XSS) attacks exploit vulnerabilities in Web-based applications that fail to properly validate and/or encode input that is embedded in response data. Malicious users can then inject client-side script into response data causing the unsuspecting user's browser to execute the script code. The script code will appear to have originated from a trusted-site and may be able to bypass browser protection mechanisms such as security zones.

ASP.NET developers may wish to use the Microsoft Anti-Cross Site Scripting Library to encode output. This library differs from other encoding libraries in that it uses the principle of inclusions and provides a high degree of protection against XSS attacks.

Learn more about the Anti-Cross Site Scripting Library
Download the Anti-Cross Site Scripting Library
Follow the tutorials

AJAX Security Concerns

Recently, I read a well done article about security concerns, and recommendations for securing Web application development, especially AJAX applications.

Since Ajax Web applications exist on both the client and the server, they include the following security issues:

• Create a larger attack surface with many more inputs to secure
• Expose internal functions of the Web application server
• Allow a client-side script to access third-party resources with no builtin security mechanisms

AJAX implementations require a trust relationship between the client and server — a relationship that can be exploited by an attacker...

The JavaScript in the Ajax engine traps the user commands and makes function calls in clear text to the server. Browser requests and Ajax engine requests look identical. The server is incapable of discerning a request made by JavaScript and a request made in response to a user action. This fact means it is very difficult for an individual to prove that they did not do a certain action.

It also means that JavaScript can make a request for a resource using Ajax that occurs in the background without the user’s knowledge. The browser will automatically add the necessary authentication or state-keeping information such as cookies to the request. JavaScript code can then access the response to this hidden request and then send more requests. This expansion of JavaScript functionality increases the possible damage of a Cross-Site Scripting (XSS) attack.

Read the whole, excellent Article "AJAX Security Dangers" by Bill Hoffmann.

ADAM - Policies...

We use ADAM (Active Directory Application Mode) for a project. To insert some users into the directory, we have written VB-Scripts. Everything worked well in our dev-environment.

But... during the setup at the customer company, we couldn't connect with the admin-user created by our VB-Script. Error-Message: 'Credentials not valid'. What happended!?

There were local policies installed, and the admin-user password didn't meet the minimal requirements, so the account was automatically disabled, without any message!

That's okay from the security point of view. But f****** hard to debug for a developer, escpecially with error messages like 'Credentials not valid'. And a kind of plain-text adsi-editor with hundrets of attributes:



After resetting the attribut "msDS-UserAccountDisabled" to false, everthing worked as expected.