# XSS and CSRF Prevention {#xss-and-csrf-prevention}


Protect against Cross-Site Scripting and Cross-Site Request Forgery.


## XSS Prevention {#xss-prevention}



### Server-Side {#server-side}


1. **Input sanitization** — all user input is sanitized via DTOs
2. **Output encoding** — template engines auto-encode
3. **Content-Security-Policy** — restrict script sources

```typescript
// class-validator on DTOs
@IsString()
@MaxLength(255)
@Transform(({ value }) => sanitizeHtml(value))
title: string;
```


### Client-Side (Angular) {#client-side-angular}


Angular auto-escapes all template bindings:

```html
<!-- Safe: auto-escaped -->
<p>{{ userInput }}</p>

<!-- Dangerous: bypasses sanitization -->
<div [innerHTML]="userInput"></div>
```

Use Angular's `DomSanitizer` for trusted HTML:

```typescript
this.sanitizer.bypassSecurityTrustHtml(trustedHtml);
```


## CSRF Prevention {#csrf-prevention}



### Token-Based {#token-based}


For cookie-based auth, use CSRF tokens:

```typescript
app.use(csurf({ cookie: true }));
```


### JWT Alternative {#jwt-alternative}


Gauzy primarily uses JWTs in the Authorization header, which is inherently CSRF-proof since:

- Tokens are in headers, not cookies
- Browsers don't auto-attach Authorization headers


## Security Checklist {#security-checklist}


- [x] Angular template auto-escaping
- [x] Server-side input validation
- [x] CSP headers configured
- [x] JWT-based auth (CSRF-resistant)
- [x] HttpOnly cookies for refresh tokens
- [x] SameSite cookie attribute


## Related Pages {#related-pages}


- [Content Security Policy](https://sourcey-gauzy.pages.dev/security/content-security-policy/index.md) — CSP configuration
- [Security Headers](https://sourcey-gauzy.pages.dev/security/security-headers/index.md) — all security headers
- [Input Validation](https://sourcey-gauzy.pages.dev/security/input-validation/index.md) — server validation