3 ms·

CORS won't do it, because it protects the response target, not the response source. CSP would do the trick, though. The other fix is properly escaping things

CORS won't do it, because it protects the response target, not the response source. CSP would do the trick, though. The other fix is properly escaping things before sticking them in your markup.

runeks 7y ago
> The other fix is properly escaping things before sticking them in your markup. Or simply not displaying user data using a markup language with built-in remote code execution.
- bzbarsky 7y ago
  Well, yes, there are various levels of "thinking outside the box" here that could be applied.