3 ms·
I mean ideally you should 1) strip tags 2) encode 3) use X-XSS headers 4) use CSP headers. That way if any one of these fails, the others will catch it. That s
by Alex3917 11y ago
I mean ideally you should 1) strip tags 2) encode 3) use X-XSS headers 4) use CSP headers. That way if any one of these fails, the others will catch it.
That said, there still shouldn't be security holes in the framework.
- andersonmvd 11y agoWell said, I agree.
- minitech 11y agoStripping tags before encoding is security theatre. Encoding is just replacing 2–4 characters; if it’s not implemented properly, there’s no way tag stripping is.