For this reason, it’s a good rule of thumb to always serve user-uploaded files from a different top-level domain, one which has no session cookies and localstor

For this reason, it’s a good rule of thumb to always serve user-uploaded files from a different top-level domain, one which has no session cookies and localstorage and the likes. This way, if someone manages to upload a file with JS in it, and trick a user into opening it, the JS cannot do any harm because it doesn’t have access to anything. This won’t stop an onslaught of incompetent security researchers from contacting you about an XSS vulnerability, because they think that XSS means anything that can do `alert` and they don’t understand what the XS in XSS stands for, but meanwhile you’re secure even if you forget (or chose to skip) sanitation. I recognize that this feels a bit out of scope for a self-contained c++ image sharing service, but if you have a more classical cloud setup, you get this for free simply by serving your user-uploaded files from some object storage bucket.