There is a link for preventing XSS in .Net Core 2.1.
It uses some code like below which I don't understand it at all.
services.AddSingleton<HtmlEncoder>( HtmlEncoder.Create(allowedRanges: new[] { UnicodeRanges.BasicLatin, UnicodeRanges.CjkUnifiedIdeographs }));
But it is for Razor, I don't use Razor. My front end is using Angular.
So how to apply it to prevent XSS in .net core 2.1?
public class Startup { public Startup(IConfiguration configuration) { Configuration = configuration; } public IConfiguration Configuration { get; } public void ConfigureServices(IServiceCollection services) {
var connectionString = configuration["myConnectionString"]; services.AddCors();
services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
service.AddDbContext<MyDbContext>(options => options.UseSqlServer(connectionString); } public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { if (env.IsDevelopment()) { app.UseDeveloperExceptionPage(); } else { app.UseExceptionHandler("/Error"); app.UseHsts(); } app.UseHttpsRedirection(); app.UseStaticFiles(); app.UseRouting(); app.UseAuthorization(); } }
Thanks.