Cross-site scripting (XSS)

Prevent XSS at the output boundary

Choose text rendering, context-aware encoding, or deliberate HTML sanitization according to how the browser will interpret the value.

Development · Developers

Configure CORS and CSP around the browser capabilities you need

Control who can read API responses and which resources a page may execute without confusing either control with authorization.

Development · Developers, AppSec engineers

Render rich text without granting it application privileges

Choose text rendering or a restricted HTML policy, then test the final DOM after every transformation.

Development · Developers, AppSec engineers

Prevent DOM XSS, postMessage abuse and client-side injection

Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.

Development · Developers, AppSec engineers

Keep generated output out of executable contexts

Choose safe rendering and narrow operations so model text cannot become browser code, database syntax or an unrestricted command.

Design, Development · Developers, AppSec engineers, Platform engineers and SREs

XSS lab: Render a model’s answer as text instead of active markup

A report page shows generated answers with a link to the cited source. The renderer inserts both as HTML, so an answer containing an image handler becomes active markup and a javascript: source becomes a clickable script. Repair the text serializer and the DOM renderer.

CORS policy lab: Grant CORS to the right origins only

An API reflects whatever Origin a request carries and allows credentials, so any website can read a signed-in user’s data from it. Repair the CORS policy so it grants access only to the configured origins and keeps caches correct.

CSP builder lab: Build a strict Content-Security-Policy

A page sends a Content-Security-Policy whose script-src allows any HTTPS origin, so an injected external script runs despite the nonce. Repair the builder so it produces a strict nonce-based policy from the document’s declared needs.

HTML sanitization lab: Configure a sanitizer for user comments

A comment feature keeps the formatting users submit, but its sanitizer configuration re-enables event handlers, unknown URL schemes and extra tags, so a comment can run script. Repair the configuration so only a small set of formatting tags and safe links survive.

Cross-site scripting (XSS)

Cross-site scripting happens when request or stored data is written into a page without encoding for the exact spot it lands in, so the browser runs it as markup or script instead of showing it as text.