Agent Guides › SAML Affiliate Agent Guide › Configure Global Settings › Handle Security Issues in Request URLs › Protect Web Sites Against Cross-Site Scripting › Specify Which Characters to Check for CSS Events

Specify Which Characters to Check for CSS Events

When CSSChecking is set to yes, the SAML Affiliate Agent scans a full URL (including the query string) for the presence of escaped and unescaped versions of the following default character set:

• left and right angle brackets (< and >)
• single quote (’)

For the SAML Affiliate Agent to check for these characters, you must set the BadCSSChars attribute to a character set of your choice.

Include the entire string of characters that you want. For example, if you set BadCSSChars to %3C, %3E (characters for left and right angle brackets), the Agent scans only for these brackets.

Important! If you experience a problem related to these characters, the SAML Affiliate Agent error log shows the following error message: Caught Possible Cross Site Scripting Violation in URL. Exiting with HTTP 403 ACCESS FORBIDDEN.

Some applications require the use of the quote characters in the query string, irrespective of the Web server platform. To use applications such as these, set BadCssChars as follows:

<BadCssChars>%3C,%3E, ’</BadCssChars>

If you omit this attribute, the SAML Affiliate Agent will not check for the any characters.