CODEWITHSUNDEEP
pythonmedium-editor
Trizzaye
Trizzaye

Reputation: 87

How does Medium.com allow embeds without being vulnerable to XSS?

Medium.com allows you to paste a link into your post (a gist or YouTube video) and it will then fetch and embed that as an <iframe> with <script> tags.

How they can do that securely without opening themselves up to attackers inserting their own XSS code?

I presume they must do some sort of sanitization on the server side but how do they differentiate between trusted <iframe> and <script> tags that they have retrieved vs. others that may be inserted by an attacker?

I'd like to do something similar with Django and Medium Editor.

Upvotes: 0

Views: 103

Answers (1)

George Bougakov
George Bougakov

Reputation: 43

They use embed.ly which

  1. Does not allow tags
  2. Allows only moderated resources

Upvotes: 0

Related Questions