title: How to prevent XSS attacks in WebAPI 2.0 not created as MVC?
body: <p>WebAPI 2.0 not created as MVC</p>
  <p>What are the security measures that need to be taken care of to prevent XSS attacks in WebAPI? I have gone through the below article
  <a href="https://docs.microsoft.com/en-us/aspnet/core/security/cross-site-scripting?view=aspnetcore-3.0" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/cross-site-scripting?view=aspnetcore-3.0</a> but it is representing MVC application. There is no startup.cs. I have this as my Global.asax.cs</p>
  <pre><code>public class WebApiApplication : System.Web.HttpApplication
  {
      protected void Application_Start()
      {
          System.Web.Http.GlobalConfiguration.Configure(WebApiConfig.Register);
          System.Web.Http.GlobalConfiguration.Configuration.Formatters.Clear();
          System.Web.Http.GlobalConfiguration.Configuration.Formatters.Add(new JsonMediaTypeFormatter());
  
          AreaRegistration.RegisterAllAreas();
          RouteConfig.RegisterRoutes(RouteTable.Routes);
  
          Hangfire.GlobalConfiguration.Configuration.UseSqlServerStorage(&quot;HangfireConnection&quot;);
      }
  }
  </code></pre>