Html encode text fields in response against XSS attacks (Cross Site Scripting)

Prevent client-side scripts to run in web browser.
Automatically encode HTML or escape chars in Ajax responses so that code in <script></script> tags cannot be evaluated. There maybe multiple targeted devices that's why encoding should be done only in web layer.
According to me, this should be done in the response not in the request because if a 3rd party is inserting an infected data to the database, ABP should encode those as well.

When you create a new role with the name : <script>alert(1)</script>
All the pages that return role name, evaluates this script. eg : https://localhost:44303/Identity/Users/CreateModal

https://docs.microsoft.com/en-us/aspnet/core/security/cross-site-scripting
https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery

Start at the reported Identity/Users/CreateModal entry point and trace how its Ajax response is produced in the web layer. Verify how role names are rendered, then confirm that a role containing script tags is returned safely and is not evaluated in the browser without breaking other response clients.