4 ms·
An XSS issue could make your users' data vulnerable.
by bastawhiz 9y ago
An XSS issue could make your users' data vulnerable.
- merb 9y agois still only an issue if you pass untrusted data to your js code.
- Klathmon 9y agoAnd there is a pretty good chance of that happening in most JS projects. Anywhere you take or show input from the user (an input box, a URL query, displaying data stored by some other system on the DB, etc...) could be a vector for an XSS attack. And it's not just data passed to JS, but data passed to HTML or any data that could make it's way into CSS in many cases!
- sakshyamshah 9y agoturns out that most of times, untrusted user supplied data slips through JS codes https://www.owasp.org/index.php/Top_10_2017-Top_10 https://www.owasp.org/index.php/Top_10_2017-Top_10
- oneweekwonder 9y agoBut cors[0] headers can mitigate some of the risk? [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
- thefreeman 9y agoNot really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.
- amenghra 9y agoYou want CSP headers to mitigate XSS risks.
- zaarn 9y agoYour backend should be double-checking any escaping the frontend does. Otherwise you can throw your fancy anti-XSS on the frontend in the bin. Also CSP helps.