Fixing stored/persistent XSS

Stored or persistent XSS is another type of cross-site scripting vulnerability. ASP.NET Core web applications that store data can be vulnerable to this XSS attack variant. Stored XSS happens when the tainted data supplied by the attacker gets saved in a persistent store or database, eventually delivered to the users by viewing these vulnerable ASP.NET Core web pages without the app output escaping the data first. In this recipe, we will fix the stored XSS vulnerability by using encoded values when displaying data on a page.

Let's see in action how the reflected XSS vulnerability can be exploited.

Testing stored XSS

Here are the steps:

1. Navigate to Terminal | New Terminal in the menu or simply press Ctrl + Shift + ' in Visual Studio Code.
2. Type the following command in the terminal to build and run the sample app:

   dotnet run

3. Open a browser and go to https://localhost:5001/Loans.
4. Log in using the following credentials:

   a...