Which is NOT an ASM protection method for cross site scripting?

Signatures are a core ASM XSS protection method that match incoming requests against known XSS attack patterns to detect and block them.

URL character set limiting restricts which characters are permitted in URLs, preventing XSS payloads from being smuggled through URL parameters.

Token injection in ASM is a protection mechanism for Cross-Site Request Forgery (CSRF), not Cross-Site Scripting (XSS). It works by embedding unique tokens in web forms to validate request origin, which addresses CSRF threats rather than XSS injection attacks. Because it targets a different vulnerability class entirely, it is not categorized as an XSS protection method.

Parameter character set limiting enforces allowed character sets on request parameters, blocking XSS injection attempts embedded in form fields or query strings.