XSS still starts when untrusted HTML reaches the browser
Encode by context, then enforce Trusted Types. The hatch is still innerHTML, v-html, and dangerouslySetInnerHTML.
Alfrik Opidi Writer
Blog
Practical security engineering for the software we all ship.
Actionable insights on secure coding, reviews, and the defenses that still hold after the framework defaults.
Featured
Latest articles
View all articlesMost Express cookie apps still do not need a JWT
Cookie session first. JWT only when a third party must verify the token.
Alfrik Opidi
IDOR still starts when the query only asks for the id
Authorize the object, do not trust the id in the URL.
Injection still starts when untrusted data reaches an interpreter
Bind parameters. Do not concatenate untrusted input into a query.
CSRF still starts when the browser sends a cookie you did not mean
Sec-Fetch-Site first, SameSite as a belt, token for login and old clients.
XSS still starts when untrusted HTML reaches the browser
Encode by context, then enforce Trusted Types. The hatch is still innerHTML.
