Chapter 1 of 7 · 4 practices · 4 min · 4-question quiz
Cross-site scripting and Trusted Types
How XSS gets into apps built with modern frameworks, the code patterns that prevent it, and how Trusted Types lets the browser enforce those patterns for you.
Start: Know where XSS still gets into framework apps4 practices in this chapter
- 1Know where XSS still gets into framework appsReact, Vue, Angular and server templates escape text by default, which removed the classic "print the query string into the page" bug. OWASP's XSS Prevention Cheat Sheet points at what is left: the…
- 2Use text sinks and validate URLs before they reach href or srcOWASP's advice is to refactor away from unsafe sinks: "use textContent or value" instead of
innerHTML. Text sinks never parse HTML, so there is nothing to escape. - 3Turn on Trusted Types to block strings at DOM sinksCode review catches some sink misuse; Trusted Types makes the browser catch all of it. With enforcement on, MDN explains, passing a plain string to an injection sink throws a
TypeError. Sinks only… - 4Layer HttpOnly cookies and CSP, but do not rely on them aloneOWASP lists CSP and cookie attributes as additional layers, not primary defenses. It helps to know what each one limits: HttpOnly session cookies stop injected script reading the cookie, but the…
Check yourself on this chapter
4 questions, right here once you are signed in. Your progress is saved as you read.