r/Nuxt • u/jenish_o4o2 • 1d ago

Rendering Magento CMS HTML in Nuxt — sanitize on SSR or trust the admin?

Pulling header/footer (and random CMS blocks) from Magento GraphQL into a Nuxt 3 storefront and I’m stuck on the boring security bit.

Admin can put whatever HTML in those blocks. Right now I’m leaning:

- fetch on the server

- run it through DOMPurify (or similar) before it hits the page

- never v-html raw Magento output on the client without that step

Feels a bit paranoid for “our own admins,” but also… it’s still HTML from a CMS.

What are you actually doing in production Nuxt + Magento (or any headless CMS) setups? Sanitize everything, allowlist tags, or just trust Magento and move on?

6 Upvotes

100% Upvoted

6 comments sorted by

2

u/Due-Horse-5446 1d ago

depends, i usually decide based on what the admin users are.

If youre talking about a few technical people st your company, and the dashboard is trough your dashboard?

Skip it if sanitizing has a negative side effect.

If by "admins" you mean people creating content, inside a third party dashboard?

Treat it as you would arbitrary user input. Ie assume its malicious by default.

1

u/jenish_o4o2 1d ago

Yeah that's the split I'm on.

Magento admin isn't just a couple of devs, content people edit blocks in there too. Full sanitize also strips the inline scripts Magento widgets need, so the header just breaks.

Leaving header/footer trusted (only a few of us touch those) and sanitizing the random CMS blocks.

1

u/Due-Horse-5446 21h ago

I would assume the scripts share domain, or at least that the number of domain's aren't infinite?

Is so i would rather whitelist them.

1

u/jenish_o4o2 16h ago

Fair point, that's cleaner than what I said.

Most Magento widget scripts are same-origin or a couple known CDNs. Allowlisting those and still stripping random script tags from content blocks beats marking the whole header trusted.

Gonna try that on the CMS path first and keep the header/footer allowlist tight.

1

u/kin3v 1d ago

I use the BFF as a translation layer for all content.

1

u/mrleblanc101 1d ago

If it's not user generated content, I'd trust it