Security Guides

XSS allows attackers to inject malicious scripts into web pages viewed by other users. To prevent XSS:

• Encode all user-supplied input before rendering in HTML
• Use context-aware encoding (HTML, JavaScript, URL, CSS)
• Implement a strict Content Security Policy
• Use modern frameworks (React, Angular, Vue) that auto-escape
• Validate and sanitize all input server-side

Clickjacking tricks users into clicking on something different from what they perceive. To prevent clickjacking:

• Set X-Frame-Options header to DENY or SAMEORIGIN
• Implement CSP with frame-ancestors directive (modern approach)
• Use JavaScript frame-busting as defense-in-depth
• Apply these headers uniformly across all pages

Path traversal allows attackers to access files outside the web root. To prevent path traversal:

• Validate all file paths against a strict allowlist
• Use canonical path resolution and verify the base directory
• Never use user input directly in filesystem operations
• Run applications with minimum required permissions
• Use chroot or similar sandboxing techniques

Open redirect vulnerabilities allow attackers to redirect users to malicious sites. To prevent them:

• Implement a strict allowlist of permitted redirect URLs
• Use server-side mapping instead of raw URLs
• Validate redirect URL against the site's origin
• Show interstitial warning before off-domain redirects
• Use relative URLs instead of absolute when possible