April 2017
Intermediate to advanced
454 pages
12h 51m
English
To prevent XSS attacks, you must ensure that no user input can appear as code in your app. This means you must be very careful about using the v-html attribute (the Output raw HTML recipe).
Unfortunately, you can't control what happens outside your page. If one of your users receives a fake e-mail that contains a link that corresponds to an action in your application, clicking on the link in the e-mail will trigger the action.
Let's make a concrete example; you developed a bank app, VueBank, and a user of your app receives the following fake e-mail:
Hello user!Click here to read the latest news.
As you can see, the mail is not even about our application and the here hyperlink is hidden in the HTML of the mail itself. In ...
Read now
Unlock full access