Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail

This conference talk explores why client-side HTML sanitization is preferable to server-side approaches for XSS mitigation. Discover the counterintuitive but compelling reasons why sanitizing user input on the client side makes more sense for HTML security. Examine common pitfalls of server-side HTML sanitization through multiple real-world vulnerability examples. Learn why traditional security wisdom about server-side validation doesn't always apply to HTML sanitization specifically. The 27-minute presentation by Yaniv Nizry, hosted by the OWASP Foundation, provides practical insights for web application security professionals looking to improve their approach to safely rendering user-generated HTML content.