# Server-side Editor API security considerations

The Server-side Editor API includes security measures to prevent malicious code execution. All scripts are analyzed before the execution to detect and block potentially dangerous operations.

<a id="restricted-operations">

## Restricted Operations

The following categories of operations are blocked for security reasons:

> **Note**
>
> **Note**: Regular HTTP calls using the CKEditor 5 API (like `fetch()` or HTTP requests through the editor’s data layer) are permitted and can be used to communicate with third-party services. The restrictions apply only to potentially dangerous browser APIs and operations.

<a id="global-functions-and-apis">

### Global Functions and APIs

The API blocks access to potentially dangerous global functions and APIs that could be used for malicious purposes:

* **Code execution functions**: `eval`, `Function`, `importScripts`
* **Timing functions**: `setTimeout`, `setInterval`, `requestAnimationFrame`
* **Network and communication**: `XMLHttpRequest`, `WebSocket`, `Worker`, `SharedWorker`, `BroadcastChannel`
* **File and data access**: `FileReader`, `indexedDB`
* **Encoding/decoding**: `atob`, `btoa`, `decodeURIComponent`
* **Storage access**: `localStorage`, `sessionStorage`
* **Browser navigation**: `history`, `import`
* **Performance monitoring**: `performance`

<a id="browser-apis-and-document-manipulation">

### Browser APIs and Document Manipulation

Access to browser-specific APIs is restricted to prevent unauthorized document manipulation and browser state changes:

* **Document creation and modification**: `document.createElement`, `document.write`, `document.writeln`, `document.createElementNS`
* **Document properties**: `document.cookie`, `document.body`, `document.head`, `document.location`
* **Window operations**: `window.open`, `window.location`, `window.postMessage`, `window.btoa`, `window.atob`, `window.document`, `window.navigator`, `window.performance`
* **URL manipulation**: `URL.createObjectURL`
* **Browser information**: `navigator.sendBeacon`, `navigator.userAgent`, `navigator.platform`
* **Performance data**: `performance.now`, `performance.getEntries`
* **History manipulation**: `history.pushState`, `history.replaceState`

<a id="element-operations">

### Element Operations

Direct manipulation of DOM elements is blocked to prevent injection attacks:

* **HTML injection**: `element.innerHTML`, `element.outerHTML`, `element.insertAdjacentHTML`
* **Event handling**: `element.addEventListener`

<a id="constructor-calls">

### Constructor Calls

Creating certain objects is restricted to prevent potential security vulnerabilities:

* **File objects**: `new Blob()`, `new File()`, `new FileReader()`
* **Communication objects**: `new WebSocket()`, `new Worker()`, `new SharedWorker()`, `new BroadcastChannel()`
* **Code execution**: `new Function()`
* **URL objects**: `new URL()`

<a id="url-schemes">

### URL Schemes

Certain URL schemes are blocked to prevent code injection and data leakage:

* **Data URLs**: `data:`
* **Blob URLs**: `blob:`
* **JavaScript URLs**: `javascript:`
* **VBScript URLs**: `vbscript:`

<a id="security-violations">

## Security Violations

If your script contains restricted operations, the API will return an error with details about the violation, including the line and column position.

> **Warning**
>
> Always test your scripts in a development environment before using them in production. The security analysis is strict and may block legitimate operations that appear suspicious.

<a id="next-steps">

## Next steps

* [Server-side Editor API Node.js example](../../examples/server-side-editor-api-examples/extract-document-content-in-nodejs.md)

---

Full index of the Cloud Services documentation: [llms.txt](../../../llms.txt)