Term
Cross-site scripting
An attack in which a malicious script is injected into a web page and then runs in other visitors' browsers, where it can steal their session or data. Proper input handling and security headers prevent it.
Updated
What it means
Cross-site scripting, or XSS, is an attack in which a malicious script is injected into a web page and then runs in other visitors' browsers. The script can steal their session and take over a logged-in account, capture form data or alter the page content.
There is stored XSS, where the malicious code is saved, for example in a comment or profile, and runs for everyone who opens the page; reflected XSS, where the code is part of a link the victim clicks; and DOM-based XSS, where the vulnerability arises in the page's own JavaScript.
Like SQL injection, XSS is one of the most common web application vulnerabilities. The cause is almost always improper handling of user input that is displayed on the page without sanitisation and executed by the browser as code.
How it works in practice
The basic defence is proper output encoding, meaning all user-supplied data is encoded before being displayed, together with input validation. Modern web frameworks do much of this automatically, but developers must be careful with exceptions where raw HTML is inserted.
Security headers add another layer, especially a content security policy that restricts where a page may load and run scripts from. Session cookies should have flags set that prevent scripts from reading them.
Regular penetration tests and updating libraries as part of patch management help detect and remove vulnerabilities. Larger companies also run bug bounty programmes that reward security researchers for reporting flaws.
What to watch out for
A WAF can catch many XSS attempts but is no substitute for secure coding. Attackers often find ways around filters, so it is important to fix the root cause in the application code itself.
If XSS leads to customers' personal data being leaked, it may be a personal data breach requiring notification of the supervisory authority and the data subjects. When commissioning a website, the contract with the supplier should include security requirements and a procedure for fixing vulnerabilities.
Need the term explained on your own situation? Consulting from €55 / hour excl. VAT, depending on topic and complexity.