4 ms·
There's a number of handy uses cases for this, but the biggest one from my point of view is another layer of defence in depth. This is something that many front
by Etheryte 6y ago
There's a number of handy uses cases for this, but the biggest one from my point of view is another layer of defence in depth. This is something that many frontend libraries already do for you (React, Vue, etc) where you have to explicitly render unsafe HTML when you want to. Making this a standardized API simply makes it more accessible and hopefully faster. It is often the case that the backend won't know what data will be rendered and what will used in another way so it makes sense to have a sanitation step before you render what you know on the frontend to be dynamic data. Put another way, even if there is a vulnerability or two in your backend that might sum up to an injection, if you also sanitize on your frontend, you'll still keep your users safe.