The first gate: nothing scripted gets in.
Before authentication even runs, every inbound payload is inspected for script injection and unsafe markup. B1 is the outermost layer of the Never Trust pipeline — deny-by-default at the door, so a hostile payload is rejected before it can reach a parser, a template, or a data store.
1. Why screen before anything else
Injection remains the most durable class of web attack because it weaponizes data the application was always going to read. Screening at the perimeter — ahead of authentication, routing, and business logic — means a script-bearing payload never reaches the components that could be tricked into executing it. B1 treats every request as untrusted input regardless of who appears to be sending it, which is the only assumption that holds when credentials and sessions can themselves be forged.
2. What B1 inspects
B1 examines the full inbound surface — query string, body, headers, and structured fields — for script injection, dangerous markup, and known evasion encodings. It normalizes input before evaluation so that double-encoded and mixed-charset payloads cannot slip past a naive pattern match. The screen is conservative by design: it is cheaper to reject a malformed request at the edge than to reason about its blast radius five layers in.
B1 is a screen, not a substitute for output encoding. The pipeline still encodes on the way out — B1 simply removes the easy, high-volume attacks before they consume any deeper resource.
3. Deny-by-default and fail-closed
If the screen cannot make a clean determination — an unparseable body, a signal source that is unreachable — the request is denied, not waved through. This fail-closed posture is the defining contract of the whole pipeline: ambiguity resolves to denial. A layer that fails open is not a security layer; it is a latent bypass waiting for the right malformed input.
4. The calling convention
B1 is configured once and enforced uniformly; there is no per-endpoint opt-out for the screen.
// B1 runs ahead of authentication in the Never Trust pipeline
services.AddB5SecurityKit(o => {
o.Screening.Xss = ScreenMode.Strict;
o.Screening.NormalizeEncoding = true; // defeat double-encoding
o.Screening.OnUndetermined = FailMode.Closed; // ambiguity => deny
});5. What an attacker actually gets
A probe carrying a script payload is rejected at the edge with no parser ever touching it; an attacker rotating encodings finds them normalized and caught; one sending a deliberately malformed body to confuse the screen is denied by the fail-closed rule. None of these requests advance to authentication, so none of them get to spend the application’s deeper attention.
6. Where this lands in an audit
B1 is the evidence for input validation and injection defense (OWASP ASVS V5; NIST CSF PR.PS; SOC 2 CC6.1, CC7.1; ISO 27001 A.8.26–A.8.28). Reviewers asking how the platform resists injection get a single, uniform answer: a deny-by-default screen that every request clears before anything else runs.
Next: B2 · Authentication — prove the caller, every request →