前端安全防护完全指南：XSS、CSRF 与点击劫持的深度防御策略#

1
// 使用 textContent
2
element.textContent = userInput;
3

4
// 使用 DOMPurify
5
import DOMPurify from 'dompurify';
6
const clean = DOMPurify.sanitize(dirtyHTML);

1
Content-Security-Policy: default-src 'self'; script-src 'self'

1
Set-Cookie: session=xxx; HttpOnly; Secure; SameSite=Strict

1
if (req.body._csrf !== req.session.csrfToken) {
2
  return res.status(403).send('Invalid token');
3
}

1
Set-Cookie: session=xxx; SameSite=Strict

1
Strict-Transport-Security: max-age=31536000; includeSubDomains

1
const helmet = require('helmet');
2
app.use(helmet());

1
import * as yup from 'yup';
2

3
const userSchema = yup.object({
4
  email: yup.string().email().required(),
5
  age: yup.number().integer().min(0).max(150)
6
});