3 ms·

Even after 5 years, you will continue to need to implement a fallback, basically forever. An attacker will always be able to use an older browser version that

• matsemann 5y ago
  That's not how XSS generally works. You need a victim to visit a trusted page where you've managed to insert some html/scripts, and then execute that in the context of the user (cookies, read sensitive data etc). If you can trick a user to use a different browser, you probably already have full control.
• jacobmischka 5y ago
  It doesn't matter if attackers can intentionally use older browsers, they can also use other tools like curl or even an intentionally malicious browser application that doesn't have these features either. It matters if users use the secure browsers, and with Chrome, Firefox, and (hopefully) Safari implementing it the vast majority of them will within a few release cycles.
• tlamponi 5y ago
  > An attacker will always be able to use an older browser version that does not have the built-in feature. You do not purify DOM for the attackers' browser, they can just open the dev console and execute arbitrary JS anyway, you purify it so that user-input that one renders is also safe for others users to see without allowing attacker controlled scripts to be executed or DOM elements that leak user info on load to be inserted. And you can always simply start to show a banner that tells "contnet blocked, upgrade your browser" in a few years, once a big enough majority of your target user base upgraded to a browser that supports it.