WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Feb 24, 2022

Securing Frontend Applications with Trusted Types

Philippe De Ryck

Stop trusting static analysis to catch elusive DOM-based XSS. Move protection directly to the browser with Trusted Types to neutralize risky bypasses and unpatched third-party vulnerabilities forever.

Pause
Mute Enter Fullscreen
#1 about 4 min

The impact of cross-site scripting in modern web applications

How injected malicious code extracts sensitive data and executes dangerous operations.

#2 about 5 min

Rendering untrusted HTML and bypassing framework escaping protections

Bypassing default framework escaping with properties like innerHTML enables cross-site scripting attacks.

#3 about 3 min

Sanitizing untrusted inputs with external libraries and default behaviors

Removing dangerous elements from HTML output prevents malicious code execution in browser sinks.

#4 about 4 min

Accidental vulnerabilities generated by missing sanitization or element references

Directly accessing native DOM properties circumvents framework protections and introduces security flaws.

#5 about 7 min

Enforcing secure assignments using trusted types and response headers

Modifying default browser behavior blocks unsafe string assignments to dangerous HTML sinks.

#6 about 4 min

Improving code security with trusted types in development environments

Catching and fixing improper DOM assignments during local development secures applications globally.

#7 about 7 min

Securing third-party dependencies with default trusted types policies

Defining a fallback sanitization policy automatically protects applications from vulnerable external packages.

#8 about 3 min

Analyzing the out-of-the-box security posture of Vue.js

The Vue.js framework provides generic output escaping but lacks automatic sanitization for raw HTML insertion.

#9 about 2 min

Contrasting server-side validation against frontend injection responsibilities

Preventing DOM-based cross-site scripting relies entirely on secure client-side code rather than API endpoints.

#10 about 2 min

Preventing attackers from creating or injecting malicious trusted types

Locking down trusted type generation blocks third-party scripts from bypassing sanitization policies.

#11 about 2 min

Handling trusted type fallbacks in unsupported web browsers

Applications maintain basic sanitization protection levels even when running in environments lacking trusted types.

#12 about 3 min

Standardizing safe markup with an upcoming native sanitization API

Future browser capabilities will expose built-in HTML sanitizers to reduce dependency on external libraries.

#13 about 2 min

Evaluating framework architectures against cross-site scripting attack vectors

Moving away from runtime template parsing blocks common attack strategies across modern web platforms.

#14 about 2 min

Evaluating the feasibility of replacing the legacy DOM API

Maintaining backwards compatibility restricts complete structural overhauls of dangerous browser operations.

Matching moments

1:44 min

Enforcing safe HTML assignments using Trusted Types policies

martinakraus martinakraus · WWC 2024

2:20 min

Enforcing strict DOM APIs using trusted types

Thomas Konrad · LIVE

1:35 min

Enhancing core browser security with the native HTML Sanitizer API

Chris Heilmann +2 · LIVE

3:37 min

Generating Trusted Types safely using the DOMPurify library

martinakraus martinakraus · WWC 2024

1:43 min

Stopping cross-site scripting attacks via secure HTML types

Michael Koppmann · LIVE

3:07 min

Implementing zero trust security practices in frontend applications

Jan Peer Stöcklmair Jan Peer Stöcklmair · WWC Europe 2026

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
5 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
12 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
19 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
26 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

Responsible AI Architecture with Zero Trust Agents

Ashok Prakash

Staff ML Engineer at Apple

Ashok Prakash
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

Architecting AI in Angular: WebMCP, A2UI, and the Agent Experience

Ankita Sood

Sr. Principal Engineer @ Secureworks | Angular GDE

Ankita Sood
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois

Related videos

Cross Site Scripting is yesterday's news, isn't it? thumbnail
30:54
WWC 2024 • almost 2 years ago

Cross Site Scripting is yesterday's news, isn't it?

martinakraus

A Primer in Single Page Application Security (Angular, React, Vue.js) thumbnail
36:39
LIVE • over 5 years ago

A Primer in Single Page Application Security (Angular, React, Vue.js)

Thomas Konrad

Friend or Foe? TypeScript Security Fallacies thumbnail
27:41
WWC 2025 • 12 months ago

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
WWC 2023 • almost 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

101 Typical Security Pitfalls thumbnail
28:41
WWC 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Trust Issues: Because Zero-Trust Isn’t Optional Anymore thumbnail
28:46
WWC Europe 2026 • about 1 month ago

Trust Issues: Because Zero-Trust Isn’t Optional Anymore

Jan Peer Stöcklmair

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.