Cross-Site Scripting (XSS)

intermediateAdditional Vector

Injecting malicious scripts into web pages viewed by other users to steal session tokens and cookies.

Detailed Overview

XSS attacks inject malicious JavaScript into trusted websites, executing in the context of the victim's browser. This allows attackers to access session cookies, local storage, and make requests as the authenticated user. XSS comes in three main types: stored (persistent), reflected (non-persistent), and DOM-based. Each variant poses unique challenges for session security.

Prevention Strategies

01Implement Content Security Policy (CSP) headers
02Validate and sanitize all user input
03Use context-aware output encoding
04Set HttpOnly flag on session cookies
05Regular security code reviews and testing

Tools

Common software used to explore or defend against this technique.

Burp Suite
OWASP ZAP
Browser DevTools
DOMPurify

BYO — Build your code

Programmatic approaches that recreate what tools do — for learning, detection, and hardening on systems you are authorized to test.

Escape HTML output

typescript

Minimal context-aware escaping before reflecting user input into HTML.

export function escapeHtml(input: string): string {
  return input
    .replaceAll("&", "&amp;")
    .replaceAll("<", "&lt;")
    .replaceAll(">", "&gt;")
    .replaceAll('"', "&quot;")
    .replaceAll("'", "&#39;");
}

// Prefer framework-safe templating + CSP in production.

CSP header helper

javascript

Express middleware sketch that ships a conservative Content-Security-Policy.

export function cspMiddleware(_req, res, next) {
  res.setHeader(
    "Content-Security-Policy",
    "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'",
  );
  next();
}