Docs menu

SDK security

CookieHug SDK security: XSS protection, style isolation, deduplication, fail-open behavior and minification.

Security

XSS Protection

All user-provided text (banner heading, description, button labels, cookie names/descriptions, i18n translations) is sanitized with escapeHtml() before being inserted into innerHTML. This prevents HTML/script injection through configuration or translation values. Text values assigned via textContent (e.g. button label updates on checkbox toggle) are not double-escaped — textContent handles escaping natively.

Style Injection Protection

All CSS values from configuration (colors, border-radius, button styles) are passed through sanitizeStyleValue() which strips dangerous characters while allowing safe CSS functions like rgb(), rgba(), hsl(), hsla(), and calc(). Dangerous patterns (url(), expression(), javascript:) are blocked entirely. The customStyles object is applied through a whitelist of safe CSS properties: fontFamily, fontSize, fontWeight, lineHeight, backgroundColor, borderRadius, border, boxShadow, padding, margin, width, maxWidth, minWidth, zIndex, opacity, color, letterSpacing.

Duplicate Loading Guard

The SDK uses a two-phase guard to prevent double initialization: _booting: true is set immediately when the SDK object is created, and _initialized: true is set only after successful initialization. If initialization fails at any point (missing script tag, invalid license, config error, runtime exception), _booting is reset to false via failBoot(), allowing a retry.

Fail-Open Protection

All API requests (license verification, configuration, translations, cookies) use a 5-second timeout via AbortController. If the CookieHug server is unreachable (network error or timeout), the SDK enters fail-open mode: all blocked scripts are unblocked, the banner is skipped, and a warning is logged to the console. This prevents the client's website from being broken by a CookieHug server outage. An explicit license rejection (HTTP 403) still blocks the banner — only network failures trigger fail-open. All errors are logged as [CookieHug] warnings in the browser console for easy debugging.

Minified Version

A minified build (cookieconsent.min.js) is available at the same base URL. Both /cookieconsent.js (full) and /cookieconsent.min.js (minified) are served with CORS headers.