Security
Chapter 68: Preventing XSS & Clickjacking
Cross-Site Scripting Anatomy, Sinks, Contextual Encoding, Sanitizer API, Trusted Types, Clickjacking & UI Redressing Defenses
-
01
What is Cross-Site Scripting (XSS)?
-
02
The Frontend Engineer XSS Defense Matrix
-
03
Dangerous HTML Sinks in JavaScript
-
04
Contextual Output Encoding & Escaping
-
05
The Modern Native HTML Sanitizer API
-
06
W3C Trusted Types API for DOM XSS Prevention
-
07
What is Clickjacking / UI Redressing?
-
08
Defending Against Clickjacking: frame-ancestors vs X-Frame-Options
-
09
Securing External Links (rel="noopener noreferrer")
-
10
Client-Side Template Injection (CSTI)