Don't serve user-written code to storefronts

Install AI ToolkitAsk about this pageCopy MD

Don't let users write JavaScript, HTML, or CSS that your app stores and then supplies to a storefront at runtime.

---

Anchor to WhyWhy

When your app accepts code from a user and serves it to a storefront, your app becomes the delivery path for that code. Anyone who can reach the setting, through a compromised merchant account, a support tool, or an unauthenticated endpoint, can run their own script for every buyer on the store.

---

Anchor to HowHow

• Offer structured settings or a fixed set of options instead, such as colors, fonts, layouts, and text that you render escaped.
• If app users need custom CSS, then validate it when it's saved, as described in Escape every value for its context. Don't accept custom JavaScript or HTML.
• If you can't remove an existing custom code setting yet, then let only the store owner change it. Use online access tokens to identify the user, keep support staff and internal tools out of it, and log every change with who made it, when, and the old and new values. The METAFIELD_OFFLINE_TOKEN check flags metafield writes that use an offline token.
• Check the custom code that you've already stored, as described in Audit stored settings and custom code.

---

Anchor to VerifyVerify

No app security check finds settings that store custom code. Find every setting that stores JavaScript, HTML, or CSS, and every place that renders it or returns it to a storefront.

---