CrossSiteScripting

Cross-Site Scripting, commonly abbreviated as XSS, is a security vulnerability in web applications that enables attackers to inject and execute malicious client-side scripts within pages viewed by other users. XSS arises when an application includes untrusted data in web pages without proper validation, escaping, or context-aware handling.

There are three main categories of XSS: reflected, stored, and DOM-based. Reflected XSS occurs when an attack payload is embedded in a request and reflected by the server in the immediate response. Stored XSS involves malicious content permanently stored on the server (for example in databases or logs) and later delivered to users. DOM-based XSS arises when the page's client-side scripts modify the Document Object Model using untrusted data, causing script execution on the user’s browser without new pages being served from the server.

Common vectors include input fields, URL parameters, user avatars or comments, and other places where user input is rendered into HTML, JavaScript, or attributes. The resulting impacts range from session hijacking and credential theft to content defacement, phishing redirects, or distribution of malware. The exact risk depends on the application's context, the user's environment, and the browser's security protections.

Prevention requires defense in depth. Key measures include validating and sanitizing input, applying proper output encoding in the correct context (HTML, JavaScript, CSS, URL), and avoiding dangerous APIs such as eval. Implementing a robust Content Security Policy, enabling HttpOnly and Secure cookies, and relying on secure frameworks with built-in escaping help reduce risk. Regular code reviews, security testing, and automated scanners complement these controls. WAFs can provide additional, but not sole, protection.

Detection and remediation involve testing for XSS during development and in production, patching vulnerable code, and educating developers about secure coding practices. Even with preventive controls, ongoing monitoring and incident response planning are essential to address new or unknown vectors.