title: XSS validation from MVC action from JSON ajax post
body: <p>Is there a way to manually call the XSS detection from MVC, such as from a filter, in cases when json is posted to an MVC action (like $.ajax post from JQuery with json content)?</p>
  
  <p>We are using MVC 5 and have no issues with standard MVC mechanisms for catching XSS ("potentially unsafe input detected"), but a few pieces of the app use <code>$.ajax</code> to post JSON ("application/json" content type) to an MVC action. In these situations, we noticed the XSS detection does not run and allows dangerous form input.</p>
  
  <p>In our investigation and research of similar questions here, we found <code>JsonValueProviderFactory</code> within the default model binder does not have same call for this XSS security that is present on form submissions or input from query string.</p>
  
  <p>While it is easy to sanitize the input on client side, we obviously need a server validation as well in order to throw a 5xx (possibly something I can wrap in a filter to share across actions that could be impacted) to force this dangerous code detection on json submitted input with default model binding if possible to avoid re-inventing the wheel or inserting html encoded bad input to our db.</p>