# What Is Cross-Site Scripting (XSS)? Examples & Defense Tips
Source: https://arsen.co/en/resources/cross-site-scripting-xss
Summary: Learn what Cross-Site Scripting (XSS) is, how it works, and how to prevent attacks with input validation, CSP, and secure coding.

## What is Cross-Site Scripting (XSS)?

Cross-Site Scripting (XSS) is one of the most common security vulnerabilities found in web applications. It allows attackers to inject malicious scripts into web pages viewed by other users. Once executed, these scripts can steal sensitive information, such as cookies, session tokens, or even manipulate the content of a web page. XSS can seriously compromise the security of a website and its users.

XSS attacks target the trust a user has in a website. If a site allows untrusted data to be displayed without proper validation or escaping, attackers can execute scripts in the user’s browser, potentially causing harm.

## Types of XSS Attacks

There are three main types of Cross-Site Scripting (XSS) attacks:

### 1. Stored XSS (Persistent XSS)

Stored XSS occurs when malicious scripts are injected into a website’s database or other data storage. Whenever the page is loaded, the script is served to users without filtering. Common targets are forums, comment sections, or message boards where user-generated content is displayed.

**Example**:
A user posts a malicious script as a comment on a blog. Each time the page is loaded, the script is executed on the viewer’s browser.

### 2. Reflected XSS (Non-Persistent XSS)

In Reflected XSS, the malicious script is embedded into a URL or another temporary source and reflected back by the server in the response. The attack is executed when a user clicks on a malicious link, and the script is reflected in the webpage without proper sanitization.

**Example**:
An attacker sends an email with a link containing a malicious script embedded in a URL query string. When the user clicks the link, the script executes and can steal session data.

### 3. DOM-based XSS

DOM-based XSS occurs when the vulnerability exists within the client-side JavaScript itself. The malicious script is executed within the Document Object Model (DOM) on the client-side, and the server is not directly involved.

**Example**:
A webpage with dynamic content generation modifies the DOM based on untrusted data, leading to malicious script execution without any server interaction.

## How XSS Attacks Impact Web Applications

Cross-site scripting can severely compromise both user and website security. Some of the dangers include:

- **Theft of sensitive information**: Attackers can steal cookies, session tokens, and other confidential data, leading to account hijacking.
- **Session hijacking**: Attackers can impersonate users and take over their accounts.
- **Website defacement**: Attackers can modify web page content, potentially damaging the site’s reputation.
- **Phishing attacks**: XSS can be used to inject fake forms or interfaces to trick users into submitting sensitive information, like passwords.
- **Malware distribution**: Attackers can inject malicious scripts that download malware onto users' devices.

## Defending Against Cross-Site Scripting (XSS)

Defending web applications from XSS requires a multi-layered approach. Below are some best practices to prevent Cross-Site Scripting vulnerabilities:

### 1. Input Validation and Sanitization

Ensure that all user input is validated and sanitized before being processed. Validate input on both the server and client side to reject suspicious or malicious data.

- **Whitelist validation**: Allow only specific, acceptable characters.
- **Blacklist filtering**: Remove or encode dangerous characters, such as `<`, `>`, `&`, and `"`.

### 2. Output Encoding

When displaying user input or data from external sources, ensure that all output is properly encoded. Use context-sensitive encoding based on where the data is being output, such as HTML, JavaScript, or URL encoding.

- **HTML encoding**: Replace dangerous characters with safe equivalents (`<` becomes `&lt;`, `>` becomes `&gt;`, etc.).
- **JavaScript encoding**: If user data is being inserted into JavaScript, ensure it’s escaped to prevent malicious code execution.

### 3. Content Security Policy (CSP)

A Content Security Policy (CSP) helps reduce the risk of XSS by controlling the sources from which scripts can be executed. A properly configured CSP can block unauthorized scripts from running, even if they’re injected into the page.

**Example CSP header**:
```http
Content-Security-Policy: default-src 'self'; script-src 'self' https://trustedsource.com; object-src 'none'
```

This policy allows scripts only from the website itself and a trusted source while blocking inline scripts and object embedding.

### 4. Avoid Inline JavaScript

Avoid the use of inline JavaScript (such as `onclick` attributes or inline `<script>` tags) as it can easily be exploited for XSS. Use external scripts or event handlers instead.

### 5. Use HTTPOnly and Secure Flags for Cookies

Set cookies with the `HttpOnly` and `Secure` flags to prevent them from being accessed through JavaScript and ensure they are transmitted only over HTTPS.

- **HttpOnly**: Prevents JavaScript access to cookies, mitigating the impact of XSS.
- **Secure**: Ensures that cookies are only sent over encrypted connections, protecting them from being intercepted.

### 6. Framework-Level Defenses

Many modern web development frameworks (such as React, Angular, and Django) have built-in protections against XSS. They automatically escape and sanitize data before rendering it in the browser.

Make sure to leverage these protections by staying up-to-date with your framework’s security features.

### 7. Regular Security Audits and Penetration Testing

Regularly audit your web application’s code and perform penetration testing to identify potential vulnerabilities. Automated tools can also help detect XSS risks in your web application.

## Conclusion: Stay Vigilant Against XSS Attacks

Cross-Site Scripting (XSS) remains a critical threat to web application security. By understanding the various types of XSS attacks and implementing robust defensive strategies like input validation, output encoding, and Content Security Policies (CSP), you can protect your website and its users from malicious exploits.

**Remember**: Security is an ongoing process. Regularly update your security practices, review your code, and monitor for vulnerabilities to stay ahead of potential attackers.