Since a company's web servers will always contain sensitive (and lucrative) information, its web applications will always present a worthwhile target for cyber criminals. When attackers are successful in their attempts to hack a company’s web servers, they can leave their victims reeling to recover losses - or put them out of business entirely.

Thankfully, with Cloudmersive Content Security APIs in your arsenal, many common web application breach attempts can be deterred - all with only a few lines of code. Below, we’ve highlighted three of our most popular Security API iterations which help prevent Cross-Site Scripting (XSS), XML External Entity (XXE) attacks, and SQL Injection (SQLI) attacks respectively.

Cross-Site Scripting (XSS) Detection & Prevention API

The goal of a Cross-Site Scripting (XSS) attack is to steal important information from your website visitors. An attacker can accomplish this easily if a website doesn’t properly validate user inputs; they’ll inject their own code into our website, and that code will subsequently execute in the browser of an unsuspecting visitor, allowing the attacker to strip information (such as login credentials) from that visitor.

The Cross-Site Scripting Detection API identifies and removes XSS attacks automatically through normalization, rendering the attackers’ actions inert and returning a normalized result string (labeled “NormalizedResult”). The information returned by this API also includes a Boolean (labeled “ContainedXss”) indicating if an XSS attack was identified, along with a string (labeled “OriginalInput”) which displays the original XSS input.

XML External Entity (XXE) Detection API

If your web application parses external XML entities, it’s critical to protect it against XXE attacks. Since XML format can store a variety of complex information, it’s possible to trick poorly configured XML parsers into referring to & accessing sensitive data based on malicious references hidden within an XML string. It's important to note that preventing XXE attacks starts with evaluating the parser itself: do you need to enable external entity processing in the first place, or can you configure your parser to only process data from sources you trust?

In any case, it’s sensible to involve a rigorous security policy in this process. Our XXE detection API makes a huge difference in the data validation process, immediately identifying malicious references buried within XML schemas and supplying a simple Boolean response (labeled “ContainedXxe”) when an XXE attack is detected.

SQL Injection (SQLI) Detection API

When client-side users query servers for information, their search is often transformed into a standard SQL query which attempts to access server information on their behalf. Attackers using a SQL Injection strategy will specifically attempt to exploit this process by including malicious queries in the user input phase. If user inputs aren’t properly validated, these queries can be inadvertently processed, bypassing our security policies and giving the attacker unrestricted access to our server data.

The SQLI Detection API enacts a critical security policy during the user input validation process. It provides a Boolean response (labeled “ContainedSqlInjectionAttack”) indicating if an SQLI attack was detected in a particular string.

For more information about our Security APIs (and additional security products), please contact our sales team.