Here is an example, how to prevent cross side scripting for the firstname & lastname input fields. If any one have the solution please advise.

        createCompanyUser ( 
            input: {   email: "[email protected]"
                        firstname: " id=X tabindex=1 onfoucs=alert(document.domain)></script>"
                        lastname: "demo'??>'><<"
                        job_title: "Developer"
                        role_id : "MTY2"
                        role_name: "Basic User"
                        status : ACTIVE
                        telephone : "3324545676"
                        country_code: "+1"
                        company_ids : "133"
                    ) {
                        user {

1 Answer 1


How to secure your magento2 store against XSS

  1. Sanitize data input: Ensure that all the data is filtered and validated at both ends (server and client) before reflecting back to the user. Such as values of search parameters, user details.

Filter out, convert special characters like < , >, /, ?, & to their HTML or URL encoded values.

  1. Implement Security Headers: Consider implementing x-xss-protection header it will block pages from loading when they detect potential xss attack.

X-XSS-Protection: 1; mode=block

or consider using Strict-Transport-Security header it will only allow execution of scripts from known, valid resources that are trusted by application.

You can override this mutation file and add validation to the input param where cross-side scripting is possible. You can also some patterns to check input string is valid or not.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.