0

I am working on a SAAS app with multiple customers, on their admin panel they have option to add code to add in header. This is a textarea which can take javascript code as input and then this code adds in header. Right now we dont have any validation for input nor while adding this to header. This can lead to a major problem as its open for xss attack

Is there any way to prevent the xss attack here

Thanks

  • More of a tip than an answer, but you can load the code from a different domain from the rest of the page content to help protect resources like Cookies and Local Storage which use "same origin" policies to protect your secrets from malicious code. There's some other things you could do with static analysis to keep from from doing some unsafe things, but I'm guessing you're doing this to allow things like Google analytics tracking which necessitates some additional "unsafe" injection. – nbering Jan 31 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.