title: How to use AntiXss with a Web API
body: <p>This is a question that has been asked before, but I've not found the information I'm looking for or maybe I'm just missing the point so please bear with me. I can always adjust my question if I'm asking it the wrong way.</p>
  
  <p>If for example, I have a POST endpoint that use a simply DTO object with 2 properties (i.e. companyRequestDto) and contains a script tag in one of its properties. When I call my endpoint from <code>Postman</code> I use the following:</p>
  
  <pre><code>{
     "company": "My Company&lt;script&gt;alert(1);&lt;/script&gt;",
     "description": "This is a description"
  }
  </code></pre>
  
  <p>When it is received by the action in my endpoint, </p>
  
  <pre><code>public void Post(CompanyRequestDto companyRequestDto)
  </code></pre>
  
  <p>my DTO object will automatically be set and its properties will be set to:</p>
  
  <pre><code>companyDto.Company = "My Brand&lt;script&gt;alert(1);&lt;/script&gt;";
  companyDto.Description = "This is a description";
  </code></pre>
  
  <p>I clearly don't want this information to be stored in our database as is, nor do I want it stored as an escaped string as displayed above.</p>
  
  <p><strong>1) Request:</strong> So my first question is how do I throw an error if the DTO posted contains some invalid content such as the  tag?</p>
  
  <p>I've looked at Microsoft AntiXss but I don't understand how to handle this as the data provided in the properties of a DTO object is not an html string but just a string, so What I am missing here as I don't understand how this is helping sanitizing or validating the passed data.</p>
  
  <p>When I call</p>
  
  <pre><code>var test = AntiXss.AntiXssEncoder.HtmlEncode(companyRequestDto.Company, true);
  </code></pre>
  
  <p>It returns an encoded string, but then what??</p>
  
  <p>Is there a way to remove disallowed keywords or just simply throw an error?</p>
  
  <p><strong>2) Response:</strong> Assuming 1) was not implemented or didn't work properly and it ended up being stored in our database, am I suppose to return encoded data as a json string, so instead of returning:</p>
  
  <pre><code>"My company"
  </code></pre>
  
  <p>Am I suppose to return:</p>
  
  <pre><code>"My Company&amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;"
  </code></pre>
  
  <p>Is the browser (or whatever app) just supposed to display as below then?:</p>
  
  <pre><code>"My Company&amp;lt;script&amp;gt;alert(1)&amp;lt;/script&amp;gt;"
  </code></pre>
  
  <p><strong>3) Code:</strong> Assuming there is a way to sanitize or throw an error, should I use this at the property level using attribute on all the properties of my various DTO objects or is there a way to apply this at the class level using an attribute that will validate and/or sanitize all string properties of a DTO object for example?</p>
  
  <p>I found interesting articles but none really answering my problems or I'm having other problems with some of the answers:</p>
  
  <ul>
  <li><p><a href="https://code-examples.net/en/q/188c96" rel="nofollow noreferrer">asp.net mvc What is the difference between AntiXss.HtmlEncode and HttpUtility.HtmlEncode? </a></p></li>
  <li><p><a href="https://stackoverflow.com/questions/12618432/stopping-xss-when-using-webapi/55200384?noredirect=1#comment103839295_55200384">Stopping XSS when using WebAPI</a> (currently looking into this one but don't see how example is solving problem as property is always failing whether I use the script tag or not)</p></li>
  <li><p><a href="https://stackoverflow.com/questions/32599961/how-to-sanitize-input-data-in-web-api-using-anti-xss-attack/36700012?noredirect=1#comment103867234_36700012">how to sanitize input data in web api using anti xss attack</a> (also looking at this one but having a problem calling <code>ReadFromStreamAsync</code> from my project at work. Might be down to some of the settings in my web.config but haven't figured out why but it always seems to return an empty string)</p></li>
  </ul>
  
  <p>Thanks.</p>
  
  <p><strong>UPDATE 1:</strong></p>
  
  <p>I've just finished going through the answer from <a href="https://stackoverflow.com/questions/12618432/stopping-xss-when-using-webapi/55200384?noredirect=1#comment103839295_55200384">Stopping XSS when using WebAPI</a></p>
  
  <p>This is probably the closest one to what I am looking for. Except I don't want to encode the data, as I don't want to store it in my database, so I'll see if I can figure out how to throw an error but I'm not sure what the condition will be. Maybe I should just look for characters such as &lt;, >, ; , etc... as these will not likely be used in any of our fields.</p>