XSS explained
How cross-site scripting works and how to prevent it: stored, reflected and DOM-based XSS with examples, what an attacker can do with a script on your page, context-aware output encoding, the safe defaults of modern frameworks and their escape hatches, sanitising HTML, Content Security Policy, and HttpOnly cookies.
CodexBash, , 5 min read
Cross-site scripting (XSS) happens when an attacker manages to run their own JavaScript inside your web page, in your visitors' browsers. Because the script runs with your site's origin, it can do anything your own code can: read the page, make requests as the logged-in user, change what they see, and steal data they type. XSS has been one of the most common web vulnerabilities for two decades. Modern frameworks prevent most of it by default, but every escape hatch, every place raw HTML is inserted, reopens the door. This article explains the attack types and the layered defences.
Sign in to read the rest
The whole 5 minute article is free with an account, along with every problem, lesson and tutorial. No card.