title: How to html encode Json response in ASP.NET Core?
body: <p>I am looking into Stored Cross-site Scripting vulnerabilities that occur when the data provided by an attacker is saved on the server, and is then displayed upon subsequent requests without proper HTML escaping.<br />
  I have NET 5 ASP.NET Core application using MVC. The application is using jQuery and Telerik's ASP.NET Core library. Both use JSON data returned from the server.</p>
  <p>The application has several action methods that query stored data in the database and return as JsonResult.</p>
  <p>For example, the following action method</p>
  <pre><code>[HttpGet]
  [Route(&quot;items/json/{id}&quot;)]
  public async Task&lt;ActionResult&gt; GetName([FromRoute] int id)
  {
      var i = await _itemService.GetWorkItem(id);
      return Json(new
      {
          ItemName = i.Name
      });
  }
  </code></pre>
  <p>and client side script shows the ItemName in html using jQuery</p>
  <pre><code>       $.get(url)
            .done(function (response, textStatus, jqXHR) {
                $(&quot;#itemname&quot;).html(response);
             })
  </code></pre>
  <p>Suppose a user has stored the name as <code>&lt;script&gt;alert('evil');&lt;/script&gt;</code> then the code above will execute the evil script on client side.<br />
  The application is using Newtonsoft as default serializer. By default the response does not get Html encoded. The response from the server looks like</p>
  <p><code>{&quot;ItemName&quot;:&quot;\u003Cscript\u003Ealert(\u0027evil\u0027);\u003C/script\u003E&quot;}</code></p>
  <p>Also setting default JsonSerializerSettings in Startup like below does not work the same way as the Html Encode.</p>
  <pre><code>var serializerSettings = new JsonSerializerSettings()
  {
      StringEscapeHandling = StringEscapeHandling.EscapeHtml
  };
  </code></pre>
  <p>Is there any default way in ASP.NET Core (Net 5) to handle html encoding during JSON serialization?</p>
  <p>I understand that there is <code>WebUtility.HtmlEncode()</code> and also <code>HtmlEncoder</code> class available which can be used to apply encoding selectively . I am looking for a solution to handle html encoding by default during the JSON serialization.</p>
  <p>Is new System.Text.Json by default applies html encoding on property values?</p>
  <p><strong>UPDATE 1</strong><br />
  The comments below suggest to configure NewtonsoftJson in startup.cs. Note that question is NOT how to configure newtonsoft globally but how to html encode property value during the serialization so client (Browser) wont execute the malicious script.
  I have tried <code>Newtonsoft.Json.StringEscapeHandling.EscapeHtml</code> which did not work. The script still executes</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
      {
          services.AddControllersWithViews()
          .AddNewtonsoftJson((options) =&gt;
          {
              options.SerializerSettings.StringEscapeHandling = Newtonsoft.Json.StringEscapeHandling.EscapeHtml;
          });
      }
  </code></pre>