I am working on a SAAS app with multiple customers, on their admin panel they have option to add code to add in header. This is a textarea which can take javascript code as input and then this code adds in header. Right now we dont have any validation for input nor while adding this to header. This can lead to a major problem as its open for xss attack

Is there any way to prevent the xss attack here


  • More of a tip than an answer, but you can load the code from a different domain from the rest of the page content to help protect resources like Cookies and Local Storage which use "same origin" policies to protect your secrets from malicious code. There's some other things you could do with static analysis to keep from from doing some unsafe things, but I'm guessing you're doing this to allow things like Google analytics tracking which necessitates some additional "unsafe" injection. – nbering Jan 31 at 14:49

It may be best to whitelist or create a bunch of pre-built JavaScript / header templates for the admin to choose from. So they're not entering raw code ... instead they fill in a few text boxes for the data you allow them to control and then your admin screen behind the scenes inserts their data into your JavaScript templates / headers.

Then you can do proper input validation just on the fields they populate and you don't have to worry about them controlling JavaScript.

Rough pseudo example:

template1: if(passesInputValidation(userinput)) { "X-SpecialHeader: {0}".format(userinput) }

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.