WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Feb 24, 2022

Securing Frontend Applications with Trusted Types

Philippe De Ryck

Stop trusting static analysis to catch elusive DOM-based XSS. Move protection directly to the browser with Trusted Types to neutralize risky bypasses and unpatched third-party vulnerabilities forever.

Pause
Mute Enter Fullscreen
#1 about 4 min

The impact of cross-site scripting in modern web applications

How injected malicious code extracts sensitive data and executes dangerous operations.

#2 about 5 min

Rendering untrusted HTML and bypassing framework escaping protections

Bypassing default framework escaping with properties like innerHTML enables cross-site scripting attacks.

#3 about 3 min

Sanitizing untrusted inputs with external libraries and default behaviors

Removing dangerous elements from HTML output prevents malicious code execution in browser sinks.

#4 about 4 min

Accidental vulnerabilities generated by missing sanitization or element references

Directly accessing native DOM properties circumvents framework protections and introduces security flaws.

#5 about 7 min

Enforcing secure assignments using trusted types and response headers

Modifying default browser behavior blocks unsafe string assignments to dangerous HTML sinks.

#6 about 4 min

Improving code security with trusted types in development environments

Catching and fixing improper DOM assignments during local development secures applications globally.

#7 about 7 min

Securing third-party dependencies with default trusted types policies

Defining a fallback sanitization policy automatically protects applications from vulnerable external packages.

#8 about 3 min

Analyzing the out-of-the-box security posture of Vue.js

The Vue.js framework provides generic output escaping but lacks automatic sanitization for raw HTML insertion.

#9 about 2 min

Contrasting server-side validation against frontend injection responsibilities

Preventing DOM-based cross-site scripting relies entirely on secure client-side code rather than API endpoints.

#10 about 2 min

Preventing attackers from creating or injecting malicious trusted types

Locking down trusted type generation blocks third-party scripts from bypassing sanitization policies.

#11 about 2 min

Handling trusted type fallbacks in unsupported web browsers

Applications maintain basic sanitization protection levels even when running in environments lacking trusted types.

#12 about 3 min

Standardizing safe markup with an upcoming native sanitization API

Future browser capabilities will expose built-in HTML sanitizers to reduce dependency on external libraries.

#13 about 2 min

Evaluating framework architectures against cross-site scripting attack vectors

Moving away from runtime template parsing blocks common attack strategies across modern web platforms.

#14 about 2 min

Evaluating the feasibility of replacing the legacy DOM API

Maintaining backwards compatibility restricts complete structural overhauls of dangerous browser operations.

Matching moments

1:44 min

Enforcing safe HTML assignments using Trusted Types policies

martinakraus martinakraus · World Congress 2024

2:20 min

Enforcing strict DOM APIs using trusted types

Thomas Konrad · LIVE

1:35 min

Enhancing core browser security with the native HTML Sanitizer API

Chris Heilmann +2 · LIVE

3:37 min

Generating Trusted Types safely using the DOMPurify library

martinakraus martinakraus · World Congress 2024

1:43 min

Stopping cross-site scripting attacks via secure HTML types

Michael Koppmann · LIVE

3:07 min

Implementing zero trust security practices in frontend applications

Jan Peer Stöcklmair Jan Peer Stöcklmair · World Congress 2026 Europe

More from WeAreDevelopers LIVE

WeAreDevelopers LIVE - Is CSS Catching Up to Flash? thumbnail
1:03:33
8 days ago

WeAreDevelopers LIVE - Is CSS Catching Up to Flash?

Chris Heilmann, Daniel Cranney, Bramus Van Damme

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along thumbnail
1:21:17
15 days ago

WeAreDevelopers LIVE - Project Chopin: Make Your Team and Agents Play Along

Chris Heilmann, Daniel Cranney, Krzysztof Cieślak

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak thumbnail
4:23
17 days ago

Fake or News - AI Toothbrushes, Carrier Pigeon Tech & Life on Mars - Krzysztof Cieślak

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Open Source Agent Toolkits thumbnail
1:00:38
22 days ago

WeAreDevelopers LIVE - Open Source Agent Toolkits

Chris Heilmann, Daniel Cranney, Eddie Jaoude

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude thumbnail
6:16
24 days ago

Fake or News - AI Music Detectors, Translating Ancient Languages & Tiny Heads in Teslas - Eddie Jaoude

Chris Heilmann, Daniel Cranney

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas thumbnail
5:46
29 days ago

Fake or News: AI Agents Hire Each Other, Spider-Man Ads in Cars & RAM Thieves - Marc Plogas

Chris Heilmann, Daniel Cranney, Marc Plogas

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:15–16:25

Outdoor Stage

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Senior Developer Advocate at TuxCare

Chris DeMars
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 5

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 24, 2026 · 09:45–10:15

Mainstage

Manufacturing trust: speed and safety in the age of agents

Mark Cavage, Michael Irwin, Hervé Bizira

Mark Cavage
Michael Irwin
Hervé Bizira
Open session

World Congress 2026 North America

September 24, 2026 · 11:00–11:30

Stage 7

Responsible AI Architecture with Zero Trust Agents

Ashok Prakash

Staff ML Engineer at Apple

Ashok Prakash
Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 3

Stop Running Mystery Meat in Production

Jeroen van Erp

Technology Advocate @ SUSE

Jeroen van Erp

Related videos

Cross Site Scripting is yesterday's news, isn't it? thumbnail
30:54
World Congress 2024 • about 2 years ago

Cross Site Scripting is yesterday's news, isn't it?

martinakraus

A Primer in Single Page Application Security (Angular, React, Vue.js) thumbnail
36:39
LIVE • almost 6 years ago

A Primer in Single Page Application Security (Angular, React, Vue.js)

Thomas Konrad

Friend or Foe? TypeScript Security Fallacies thumbnail
27:41
World Congress 2025 • about 1 year ago

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
World Congress 2023 • almost 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Trust Issues: Because Zero-Trust Isn’t Optional Anymore thumbnail
28:46
World Congress 2026 Europe • 3 months ago

Trust Issues: Because Zero-Trust Isn’t Optional Anymore

Jan Peer Stöcklmair

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.