> For the complete documentation index, see [llms.txt](https://tech.x2bee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tech.x2bee.com/dev-guide/developer-guide-en/dev-start/markdown/xss-protection.md).

# XSS Protection

X2BEE provides the `XssSanitizer` custom annotation and `XssProtectUtils` methods for XSS protection.

## `xss-rule.yml`

Configure the whitelist in `resources/config/xss-rule.yml`. The `direction` option supports `request`, `response`, and `both`. Define permitted `allowElements`, `allowAttributes`, and URL-specific `allowUrls` patterns such as `/api/display/**/url`.

```yaml
xss:
  direction: response
  allowElements:
    - a
    - img
    - div
    - ul
    - li
    - link
    - input
```

## `XssSanitizer`

Annotate a response-model field with `@XssSanitizer`. During JSON serialization, the MessageConverter retains only values allowed by `XssProtectUtils.getHtmlSanitizer`.

## Use `XssProtectUtils` in business logic

Inject `XssProtectUtils` or use its singleton to sanitize values before returning them from a Controller. Preserve the original Java classes, annotations, endpoints, and method names.