Securing Frontends at Scale: Paving our Way to the Post-XSS World

Cross-site scripting remains a large share of the web bugs Google receives through its bug bounty program. The speaker, who works on web security mitigations across hundreds of Google web apps, explains the core problem: templates and DOM APIs blur the line between data and code, and a single careless change can reintroduce an injection that is hard to find and remove later.

The talk then walks through defenses in layers. Context-aware templating and frameworks that sanitize by default make the safe choice the easy one, with Angular's sanitizer and its explicitly named bypass function used as an example of a deliberate warning sign. Build-time conformance checks flag risky APIs such as innerHTML during development, and an ESLint-based open-source project called safety-web brings some of these checks to outside teams. Wrapper types checked by TypeScript help track which markup is safe as data moves from storage through formatting to the browser.

For runtime protection, the speaker recommends nonce- or hash-based Content Security Policy with strict-dynamic, plus Trusted Types to block unsafe DOM sinks. The closing idea is to lock dangerous DOM APIs down by default and offer safe replacement platform APIs, an approach called perfect types. Practitioners should take away that developer experience is central to making these protections stick.