I would like to change the default encoder for ASP.NET 4 running with Ubuntu Linux 16.04 operating system on a Lenovo Thinkstation desktop and apache server 2.0 and mod-mono-server4.exe.

My question is whether the following recipe will work properly with the .NET Mono 4.0 libraries installed on Ubuntu 16.04. What are the advantages of this approach over, since we you using a version of .NET earlier than 4.5(i.e ASP.NET 4.0), where we use the following encoderType setting as shown below.

  <httpRuntime encoderType="Microsoft.Security.Application.AntiXssEncoder, AntiXssLibrary" />

which has been proven to function correctly with the .NET Mono 4.0 libraries installed on Ubuntu 16.04.

James Jardine posted on July 9, 2011 the recipe in this URL, [https://www.jardinesoftware.net/2011/07/09/asp-net-4-change-the-default-encoder/] titled ASP.Net 4: Change the Default Encoder

Quoting from this nice article, "In ASP.Net 4.0, Microsoft added the ability to override the default encoder. This is specifically focused on the HTMLEncode, HTMLAttributeEncode, and URLEncode functionality. These functions are used, in the eyes of security, to help mitigate cross-site scripting (XSS). The problem with the built in .Net routines is that they are built on a black-list methodology, rather than a white-list methodology. The built in routines use a very small list of characters that get encoded. For example, the .Net version of HTMLEncode encodes the following characters: <,>,”,&. The Microsoft Web Protection Library (previously known as the Anti-XSS Library) instead determines all characters that don’t need encoding, a-z0-9 for example, and then encodes all the rest. This is a much safer approach to encoding.

In this post, I will show you how to use the Web Protection Library as the default encoder for an ASP.Net 4.0 application. The first step is to download the Web Protection Library. In this example, I use version 4.0 which can be found at: http://wpl.codeplex.com/.

Next, you will need to have an application to implement this. You can use an existing application, or create a new one. Add a reference to the AntiXSSLibrary.dll.

To use the library, it is time to create a new class. You can see the code in my class in Figure 1. I named the class “MyEncoder” and this is just a sample. (THIS IS NOT PRODUCTION CODE) There are two important factors to this class:

  1. The class must inherit from System.Web.Util.HttpEncoder.

  2. You must override each Encode Method you want to change.

Figure 1

using System;
using System.Web;

public class MyEncoder : System.Web.Util.HttpEncoder
    public MyEncoder(){}

    protected override void HtmlEncode(string value, System.IO.TextWriter output)
       if (null == value)


    protected override void HtmlAttributeEncode(string value, System.IO.TextWriter output)
        if (null == value)

The final step to implementing this custom encoding is to update the Web.config file. To do this, modify your httpRuntime element to have the “encoderType” attribute set, as seen in Figure 2. Change “MyEncoder” to the name of the class you created. If you do not have the httpRuntime element, just add it in.

Figure 2

        <compilation debug="true" targetFramework="4.0"/>
        <httpRuntime encoderType="MyEncoder"/>
  • I am going to test this custom class shortly and report back to anyone still interested. This question is of major significance to Unix and Linux users of ASP.NET > 3.5 meaning ASP.NET 4.0 and ASP.NET 4.5 because you will get a nasty ambiguous run-time exception. Thank you. – Frank Jul 4 '16 at 23:22

Yes, a custom encoding C# class will function properly with the Mono .NET 4.0 libraries installed on Ubuntu 16.04.

After battling with the .NET 4.0 HttpEncoder feature described in


for an hour , I got this exception:

The actual exception which was being reported was:
System.Web.HttpException: Code generation failed. ---> System.Configuration.ConfigurationErrorsException: Could not load type 'AntiXssEncoder, AntiXssLibrary'.
  at System.Web.Util.HttpEncoder.GetCustomEncoderFromConfig () <0x40e99f10 + 0x0015f> in <filename unknown>:0 
  at System.Lazy`1[T].CreateValue () <0x40e8cc80 + 0x001d2> in <filename unknown>:0 
--- End of stack trace from previous location where exception was thrown ---
  at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw () <0x40ea1490 + 0x00033> in <filename unknown>:0 
  at System.Lazy`1[T].get_Value () <0x40e8c580 + 0x000cc> in <filename unknown>:0 
  at System.Web.Util.HttpEncoder.get_Current () <0x40e99c50 + 0x0006f> in <filename unknown>:0 
  at System.Web.HttpUtility.HtmlEncode (System.String s) <0x40e99b80 + 0x00053> in <filename unknown>:0 
  at System.Web.HttpException.HtmlEncode (System.String s) <0x40e99ae0 + 0x00047> in <filename unknown>:0 
  at System.Web.HttpException.FormatFullStackTrace () <0x40e98510 + 0x001cf> in <filename unknown>:0 
  at System.Web.HttpException.GetHtmlErrorMessage () <0x40e968f0 + 0x001d3> in <filename unknown>:0 
  --- End of inner exception stack trace ---
  at System.Web.Compilation.BuildManager.GenerateAssembly (System.Web.Compilation.AssemblyBuilder abuilder, System.Web.Compilation.BuildProviderGroup group, System.Web.VirtualPath vp, Boolean debug) <0x40eb3f10 + 0x0045f> in <filename unknown>:0 
  at System.Web.Compilation.BuildManager.BuildInner (System.Web.VirtualPath vp, Boolean debug) <0x40ea7280 + 0x0057b> in <filename unknown>:0 
  at System.Web.Compilation.BuildManager.Build (System.Web.VirtualPath vp) <0x40ea6c90 + 0x0014b> in <filename unknown>:0 
  at System.Web.Compilation.BuildManager.GetCompiledType (System.Web.VirtualPath virtualPath) <0x40ea6940 + 0x00093> in <filename unknown>:0 
  at System.Web.Compilation.BuildManager.CreateInstanceFromVirtualPath (System.Web.VirtualPath virtualPath, System.Type requiredBaseType) <0x40ea6800 + 0x00033> in <filename unknown>:0 
  at System.Web.UI.PageParser.GetCompiledPageInstance (System.String virtualPath, System.String inputFile, System.Web.HttpContext context) <0x40ea6460 + 0x000bb> in <filename unknown>:0 
  at System.Web.UI.PageHandlerFactory.GetHandler (System.Web.HttpContext context, System.String requestType, System.String url, System.String path) <0x40ea6420 + 0x00027> in <filename unknown>:0 
  at System.Web.HttpApplication.GetHandler (System.Web.HttpContext context, System.String url, Boolean ignoreContextHandler) <0x40e7e970 + 0x002de> in <filename unknown>:0 
  at System.Web.HttpApplication.GetHandler (System.Web.HttpContext context, System.String url) <0x40e7e940 + 0x0001b> in <filename unknown>:0 
  at System.Web.HttpApplication+<Pipeline>c__Iterator1.MoveNext () <0x40e80000 + 0x02a5f> in <filename unknown>:0 

So, I fixed this exception by researching c# Type.GetType(typename, false) In this URL, [https://stackoverflow.com/questions/31613899/why-do-i-have-to-specify-the-assembly-in-my-app-config-but-not-for-my-web-config], @rene wrote:

"If the type is in the currently executing assembly or in Mscorlib.dll, it is sufficient to supply the type name qualified by its namespace."

"It is adviced to always specify the assemblyname. In the asp.net scenario, if the assemblyname is present in the type parameter it short-circuits to the Type.GetType call which prevents the loading and inspection of all dll's in the bin folder of your webapp."

1. Compiing:

   sudo mcs -t:library -r:../bin/System.dll -r:/usr/lib/mono/gac/System.Web/ -r:../bin/AntiXSSLibrary.dll     MyEncoder.cs

which builds the assembly MyEncoder.dll which I copy into the bin folder and add as an external reference to my csproj. Please do not put System.Web.dll in your ASP.NET application's bin folder.

  1. Changing the encoderType in Web.config's httpRuntime line to read:

  • 3. Change the encoderType in Web.config's httpRuntime line to read: <httpRuntime executionTimeout="4800" maxRequestLength="2097151" encoderType="HVR_Web_App.AntiXssEncoder, MyEncoder"/> – Frank Jul 5 '16 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.