XssMw provides an "auto remove XSS" from all user submitted input. It's applied on POST, PUT, and GET Requests only. We currently support three Request types: * JSON requests - Content-Type application/json * Form Encoded - Content-Type application/x-www-form-urlencoded * Multipart Form Data - Content-Type multipart/form-data XSS filtering is performed by HTML sanitizer https://github.com/microcosm-cc/bluemonday The default is to the strictest policy - StrictPolicy()