XSS Prevention: Output Encoding, Sanitization, CSP, and Trusted Types

XSS Prevention: Output Encoding, Sanitization, CSP, and Trusted Types

Cross-Site Scripting (XSS) happens when untrusted data reaches a browser execution context and is interpreted as code instead of data.

Prefer Safe Framework Rendering

Modern frameworks normally escape text inserted through standard rendering APIs. Keep that protection enabled and avoid escape hatches such as raw HTML rendering unless the feature genuinely requires it.

Prefer safe DOM sinks such as textContent over innerHTML for plain text.

Encode for the Correct Context

HTML, attributes, URLs, JavaScript, and CSS have different parsing rules. Use context-aware output encoding instead of one generic “escape” function.

Never place untrusted data directly into executable JavaScript or event-handler contexts.

Sanitize HTML When Users Must Author HTML

If a rich-text feature intentionally accepts HTML, output encoding would break the formatting. Use a maintained HTML sanitizer such as DOMPurify with an appropriately restricted policy.

untrusted rich HTML → sanitizer → allowed HTML → render

Do not sanitize and then mutate the result through another unsafe library/sink.

Use CSP as Defense in Depth

A well-designed Content Security Policy can reduce the impact of an XSS bug by restricting which scripts/resources the page may execute.

CSP does not replace output encoding or sanitization. Poorly designed CSPs with broad unsafe exceptions provide little protection.

Trusted Types for DOM XSS

The Trusted Types API can restrict dangerous DOM injection sinks so they do not accept arbitrary strings. In modern browsers, CSP directives such as require-trusted-types-for 'script' can force risky DOM operations through approved transformation policies.

This is especially valuable for large frontend codebases, but it complements rather than replaces secure rendering.

Final Takeaway

Prevent XSS by keeping untrusted values as data: rely on safe framework rendering, encode for the destination context, sanitize intentionally supported HTML, avoid dangerous DOM sinks, and add CSP/Trusted Types as extra containment layers.

References

• OWASP XSS Prevention Cheat Sheet
• MDN Content Security Policy
• MDN Trusted Types