XSS

Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It is one of the most common web application vulnerabilities, consistently ranked in the OWASP Top 10.

Category: Security (also: Web Development)

Author: Atomic Glue Security Team

## Definition

XSS is an injection attack where an attacker manages to get a browser to execute JavaScript that was not intended by the application developer. The injected script runs in the context of the victim's session on the target site, giving it access to cookies, localStorage, session tokens, page content, and the ability to make requests on the user's behalf. XSS can lead to account takeover, data theft, session hijacking, and malware distribution.

## Types of XSS

**Reflected XSS**: The injected script is part of the request (e.g., a search query or URL parameter) and is immediately reflected back in the response. The victim must click a crafted link. **Stored XSS**: The injected script is permanently stored on the server (e.g., in a comment field, forum post, or user profile) and executed when other users view the page. This is more dangerous as it does not require a targeted link. **DOM-based XSS**: The vulnerability exists entirely in client-side JavaScript that writes attacker-controlled data to the DOM without server involvement.

## Prevention

The primary defense against XSS is **context-aware output encoding**. Encode data differently depending on where it appears: HTML entity encoding for HTML body context, JavaScript string encoding for script context, URL encoding for URL attributes. Modern frameworks (React, Vue, Angular) auto-encode in templates, but raw HTML insertion (dangerouslySetInnerHTML, v-html) bypasses these protections. CSP acts as a critical second line of defense.

## Impact and Real-World Examples

XSS was responsible for the Twitter Storm worm (2010) that auto-tweeted via stored XSS. The Samy worm on MySpace (2005) infected over one million profiles in under 20 hours. More recently, Magecart groups use XSS to inject credit card skimmers into e-commerce sites. XSS consistently ranks in the OWASP Top Ten.

## Note

XSS is often confused with CSRF. XSS attacks the user's browser; CSRF forges the user's browser to attack the server. CSP can mitigate XSS but does not replace proper output encoding.

## Common questions

Q: Is XSS still relevant in modern frontend frameworks?

A: Yes. React, Vue, and Angular prevent XSS in template expressions, but bypasses exist: dangerouslySetInnerHTML, v-html, user-provided CSS, URL injection, and server-side template injection.

Q: Does HTTPS prevent XSS?

A: No. HTTPS encrypts the connection but does not prevent injection attacks. XSS happens in the application layer, independently of transport encryption.

Q: What is the difference between XSS and SQL injection?

A: XSS targets users' browsers by injecting JavaScript into web pages. SQL injection targets the database by injecting SQL commands into queries. Both are injection attacks at different layers.

## Key takeaways

• XSS is an injection attack where malicious scripts run in a victim's browser.
• Three types: Reflected, Stored, and DOM-based.
• Primary defense: context-aware output encoding. Secondary defense: CSP.
• Modern frameworks help but do not eliminate the need for secure coding practices.

## Related entries

• [CSP](atomicglue.co/glossary/csp-backend)
• [CSRF](atomicglue.co/glossary/csrf)
• [SQL Injection](atomicglue.co/glossary/sql-injection)
• [Security Headers](atomicglue.co/glossary/security-headers)

Last updated December 2024. Permalink: atomicglue.co/glossary/xss