Category: Security

Chrome DevTools XPath safety - escape the JavaScript literal not the XPathArticle contains
  1. When a simple XPath field becomes Remote Code Execution (RCE)
  2. Why document.evaluate itself is innocent
  3. The JavaScript meta-character trap
  4. Sanitizing XPath
  5. Integration recipes
  6. Solutions that fail security review
  7. Short security checklist
  8. Final words
A piece of code with the words "Security Alert" on it. Image by Elchinator from Pixabay.

Chrome DevTools XPath safety – escape the JavaScript literal not the XPath

XPath, or XML Path Language, is a query language designed to navigate through elements and attributes in an XML document. The document.evaluate() method in JavaScript allows developers to execute XPath expressions against an XML document, returning nodes or values based on the specified query. While this functionality is powerful, it also poses risks of injection attacks if user input is not properly handled.

Continue reading “Chrome DevTools XPath safety – escape the JavaScript literal not the XPath”
Balancing accessibility and security - how to protect user data on inclusive websitesArticle contains
  1. Understanding accessibility and security
  2. Best practices for accessibility
    1. Use semantic HTML
    2. Provide text alternatives
    3. Ensure keyboard accessibility
    4. Use ARIA (Accessible Rich Internet Applications) landmarks
    5. Test with real users
  3. Best practices for security
    1. Use HTTPS
    2. Implement strong authentication
    3. Sub-resource integrity (SRI)
    4. Regular security audits and updates
    5. Data encryption
    6. Educate users
  4. Balancing accessibility and security
    1. Secure and accessible authentication
    2. Accessible error messages
    3. Privacy by design
    4. Regular testing and monitoring
    5. Stay informed and compliant
    6. Leveraging VPNs for enhanced security
  5. Zero-friction checklist
  6. Conclusion
Hands typing on a laptop

Balancing accessibility and security – how to protect user data on inclusive websites

For any online business in 2025, having a website that’s both accessible and secure is paramount. Accessibility ensures that all users, regardless of their abilities, can navigate and interact with your site. Security, on the other hand, protects user data from breaches and cyberthreats.

Balancing these two aspects can be challenging and yet they reinforce each other: an insecure site is unusable for everyone, while an inaccessible site often leaks data through work-arounds. This article gives you a single 10-item checklist you can drop into your next sprint.

Continue reading “Balancing accessibility and security – how to protect user data on inclusive websites”