title: How to validate soap webservice request parameters for XSS attcaks in java
body: <p>how do i secure my api from Client site scripting attcaks or XSS attcaks?</p>
  
  <p>we have a soap endpoint which is accessed by many clients and the incoming request data is to be validated for the correctness and security. </p>
  
  <p>there is a chance that incoming request may have DOM object model or any suspicious data that breaks the application.</p>
  
  <p>like below,</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:cus="http://www.abcxyz.com/aaa/bbb" xmlns:ws="http://www.abcxyz.com/aaa/bbb"&gt;
     &lt;soapenv:Header&gt;
        **&lt;cus:id&gt;
           &lt;SCRIPT&gt;a=/XSS/alert(a.source)&lt;/SCRIPT&gt;
        &lt;/cus:id&gt;**
     &lt;/soapenv:Header&gt;
     &lt;soapenv:Body&gt;
        &lt;cus:cancelRequest&gt;
           &lt;!--Optional:--&gt;
           &lt;ws:transactionId&gt;10000&lt;/ws:transactionId&gt;
           &lt;ws:systemId&gt;CCC&lt;/ws:systemId&gt;
           &lt;ws:userId&gt;USER_NAME&lt;/ws:userId&gt;
           &lt;cus:cancelElements&gt;
              &lt;cus:elementType&gt;NAME&lt;/cus:elementType&gt;
              &lt;cus:elementId&gt;AB123&lt;/cus:elementId&gt;
           &lt;/cus:cancelElements&gt;
        &lt;/cus:cancelRequest&gt;
     &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>if there is any attacks from a hacker by passing maliciouse data as part of request parameters then i need to handle it and thro an error or don't allow the data to get processed.</p>