Security Hygiene & Sanitization

Overview

Security hygiene covers the defensive coding practices that prevent common web vulnerabilities: cross-site scripting (XSS), SQL injection, cross-site request forgery (CSRF), header injection, and path traversal. In .NET, these protections come from built-in encoders (System.Text.Encodings.Web), parameterized queries, antiforgery tokens, and secure HTTP header middleware. Proper hygiene means validating all input at the boundary, encoding all output for its context, and applying defense-in-depth with HTTP security headers.

Output Encoding for XSS Prevention

Always encode output based on the rendering context: HTML body, HTML attribute, URL, or JavaScript.

using System.Text.Encodings.Web;
using Microsoft.AspNetCore.Mvc;

public class SafeOutputController : ControllerBase
{
    private readonly HtmlEncoder _htmlEncoder;
    private readonly UrlEncoder _urlEncoder;
    private readonly JavaScriptEncoder _jsEncoder;