Some modern tools to mitigate XSS&#x2F;make XSS virtually impossible:<p>- Content-Security-Policy <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;CSP&#x2F;Introducing_Content_Security_Policy" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en-US&#x2F;docs&#x2F;Web&#x2F;Security&#x2F;CSP&#x2F;In...</a><p>- The sandbox attribute on iframes: <a href="https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en&#x2F;docs&#x2F;Web&#x2F;HTML&#x2F;Element&#x2F;iframe#Attributes" rel="nofollow">https:&#x2F;&#x2F;developer.mozilla.org&#x2F;en&#x2F;docs&#x2F;Web&#x2F;HTML&#x2F;Element&#x2F;ifram...</a><p>XSS is one of the hardest things to keep under control at scale.