What is Cross-site-scripting and how does it work?

Cross-Site Scripting (XSS)

🔎 What is Cross-Site Scripting?

Cross-Site Scripting (XSS) is a client-side code injection vulnerability that allows an attacker to inject malicious scripts into web applications.

• It circumvents the Same-Origin Policy, which is designed to segregate websites from one another.
• Attackers can masquerade as a victim user, carry out actions on their behalf, and steal sensitive data.
• If the victim is a privileged user (e.g., admin), an attacker may gain full control over the application’s functions and data.

📝 OWASP Explanation

According to OWASP:

• The malicious content is often JavaScript, but it can also be HTML, Flash, or any other browser-executable code.
• Common attack goals include:
  • Stealing session cookies or authentication tokens
  • Redirecting users to attacker-controlled content
  • Running arbitrary operations on the victim’s machine while appearing to come from the trusted site

❓ Why Does XSS Occur?

XSS occurs when applications:

• Fail to properly sanitize or encode user-supplied input
• Reflect untrusted data directly into HTML, JavaScript, or attributes without escaping
• Dynamically generate web pages without validating or filtering inputs

Essentially, any place where user input is included in a page’s output without safe handling is a potential XSS sink.

🛡️ How to Prevent XSS?

1. Input Validation & Output Encoding

• Treat all user input as untrusted.
• Apply context-aware output encoding:
  • HTML entity encoding for data inside HTML
  • Attribute encoding for data in tag attributes
  • JavaScript escaping for data inside scripts
  • URL encoding for data in query strings

2. Content Security Policy (CSP)

• Implement a strong CSP header to restrict sources of executable scripts.
• Helps mitigate XSS by disallowing inline JavaScript and restricting resource loading.

3. Use Secure Frameworks

• Modern frameworks (e.g., React, Angular, Vue) have built-in protections against XSS by auto-escaping outputs.
• Avoid disabling these features.

4. Sanitize User-Generated HTML

• If your app requires rich text or HTML input, use libraries like DOMPurify to clean it.
• Never allow direct insertion of unsanitized HTML into the DOM.

5. HttpOnly Cookies

• Store session tokens in HttpOnly cookies to prevent access from injected JavaScript.

✅ Key Takeaway

XSS is one of the most common web vulnerabilities.
The best defense is secure coding practices: validate inputs, encode outputs, and apply defense-in-depth with CSP and modern frameworks.