Securing SPAs with Trusted Types

XSS vulnerabilities remain a top threat to any HTML-based web application. In fact, 75% of web vulnerabilities in Google's reward program are XSS vulnerabilities! Fortunately, built-in platform defenses such as Content Security Policy and Trusted Types equip us with the tools to tackle XSS. In this article, we briefly look at modern XSS vulnerabilities, followed by a detailed look at using Trusted Types policies to mitigate such vulnerabilities. In the end, we provide you with a list of concrete developer guidelines to apply Trusted Types in your projects.

15 June 2021 Security Policies Browser Security, Content Security Policy (CSP), XSS, Trusted Types

This article is published as a guest post on Auth0’s blog. You can read the full article over there.