Reverse Proxy Based XSS filtering

Abstract

Due to the increasing amount of Web sites offering features to contribute rich content and the frequent failure of Web developers to properly sanitize user input, cross-site-scripting prevails as the most significant security threat to Web applications. Using cross-site scripting techniques, a malicious user can hijack Web sessions, craft credible phishing sites and using the browser based exploits can have complete access to victim machine. Previous work towards protecting against cross-site scripting attacks suffers from various drawbacks, such as practical infeasibility of deployment due to the need for client-side modifications, inability to reliably detect all injected scripts, and complex, error-prone parameterization. In this paper, we introduce a server-side solution for detecting and preventing cross-site scripting attacks using reverse proxy that intercepts all HTML responses, and allow or deny the request based on filtering techniques using regular expressions and blacklisting techniques.