XSS

XSS (Cross-Site Scripting) is one of the most common web application vulnerabilities. It consists of injecting malicious code, most often JavaScript, into the content of a page that is then displayed and executed in the browser of another, unsuspecting user. The script runs in the context of the trusted site, so it can steal session cookies, capture form data or perform actions on the victim's behalf.

Types of XSS

There are three main variants. Stored XSS saves the payload on the server — for example in a comment — and attacks everyone who opens the infected page. Reflected XSS carries the payload in a URL and runs when the victim clicks a crafted link. DOM-based XSS manipulates the page entirely in the browser. In every case the root cause is trusting unverified input.

Protection

Effective defence combines several layers. It is essential to encode output according to its context (HTML, attribute, JavaScript) and to validate input. A Content-Security-Policy header limits where the browser may load and execute scripts from, and marking cookies as HttpOnly makes them harder to steal. Transmission over HTTPS protects data in transit, and a web application firewall (WAF) can filter out common attack patterns. XSS is often combined with other techniques, such as CSRF, so application security should be treated holistically rather than as a single patch. Regular security testing and keeping dependencies up to date help catch XSS vulnerabilities before they reach production and are exploited.