installation question

May 30, 2011 at 5:46 PM
Edited May 30, 2011 at 5:47 PM

Hi there, i am a bit confused concerning antixss installation.

I mean, how should i handle antixss installation for a development machine, for a shared and for a dedicated hosting environment.

Should i install the .msi installation file or not? Should i reference the library from the GAC or should i make a private copy inside the application's bin folder and reference it from there?

thanks in advance

May 30, 2011 at 8:17 PM

The library never goes into the GAC, at least not with the standard installer, it will go into %ProgramFiles%. So when you add a reference it VS should set Copy Locally to be true, and put a copy into your bin folder itself, without the need to manually copy. If you install via Nuget that gets done for you too.

May 31, 2011 at 9:18 AM
Edited May 31, 2011 at 9:19 AM

Unfortunately i use VS Studio 2008 for the moment, so Nuget is not an option.

So you suggest to run the installer on my development machine, reference the library from %ProgramFiles%, set Local Copy to true in order for the library to get copied inside bin folder and finally add a corresponding element inside web.config file and that's all? I can then use the library and upload it to my shared hosting environment?

May 31, 2011 at 1:55 PM

Yup - although what's the web.config entry for? In 2008/AntiXSS 4.0 there's no need for one.

May 31, 2011 at 4:16 PM

I have seen the following in a tutorial under system.web: <httpRuntime encoderType="AntiXssEncoder, AntiXssWeb"/>

I guess there is no neeed for this, so just adding the reference is good enough.


May 31, 2011 at 4:41 PM

Ah you mean Phil's tutorial? That's a bit out of date, the namespace and methods are wrong.

v4.1 will have an implementation to swap out encoders - if you're happy trying beta code you can grab the source, that class is in there.

Jun 1, 2011 at 8:18 AM

Yes, Phil's tutorial. Ok about this.

I i'd like to stick with non-beta releases, so v4 is just fine.

Also, i am targeting .net 3.5 sp1. I guess there is no problem with this.