Browser & Web Performance · Senior · Question 54 of 75
Where should HTML from users be sanitized in a system that renders it in a web app and a mobile app?
- 1Nowhere, if the content is behind authentication
- 2Only once in the database migration
- ✓Correct answer: At output in each client (with a context-aware sanitizer), optionally also on the server, keeping the original stored
Explanation
Sanitizers and rendering contexts change over time. Sanitizing at render time with up-to-date rules protects against stored payloads.