XSS (cross-site scripting)
Attacker-controlled script running in your page in another user’s browser, with that user’s session.
It happens when user input reaches the page as HTML instead of text: a comment, a profile name, an uploaded SVG, a URL parameter. The script can then act as the victim, read data on the page or send requests. Frameworks such as React escape text by default; the holes are the escape hatches, such as raw HTML rendering, and unsafe URLs in links.
Related terms
- CSP (Content Security Policy): An HTTP header that tells the browser which scripts, styles and connections a page may use, limiting the damage of injected code.
- CSRF (cross-site request forgery): Another site making a logged-in user’s browser send a request to your app, which the app trusts because the cookie came along.
- OWASP Top 10: The OWASP Foundation’s list of the ten most critical web application security risks, updated every few years.
