Home/ Glossary/ Cross-Site Scripting

Cross-Site Scripting (XSS)

Security Glossary - Web Security

Definition: Cross-Site Scripting is an injection vulnerability in which untrusted data is interpreted as executable browser content in another user's security context. Impact can include unauthorized actions, accessible data exposure, redirects, page modification, or credential capture; HttpOnly cookies are not directly readable by JavaScript.

At a Glance

  • Attacker injects malicious scripts into web pages viewed by other users
  • Three types: Stored (persistent), Reflected (non-persistent), DOM-based
  • Primary defense: output encoding and Content Security Policy
  • Can perform authorized-looking actions, redirect users, or modify page content
  • Covered by the Injection category in the current OWASP Top 10

Why XSS Matters

OWASP Top 10:2025 includes XSS under A05 Injection. It occurs when an application places untrusted data into an executable browser context without context-appropriate output encoding, sanitization, or safe DOM APIs. Common descriptions include stored, reflected, and DOM-based XSS.

The impact of XSS ranges from nuisance (page defacement) to critical (session hijacking, credential theft). An attacker exploiting XSS on a banking site could transfer funds. On a social media site, they could spread malware to all of a user's contacts.

Defenses depend on context: safe framework APIs, context-appropriate output encoding, HTML sanitization when HTML is intentionally allowed, URL validation, and avoiding unsafe DOM sinks. A strict nonce- or hash-based CSP is valuable defense-in-depth in supporting browsers but does not fix the injection flaw.

How to Check

DomainOptic can report whether a CSP header is present, but it does not test application-level XSS or prove that the policy is strict. Use code review, framework-specific analysis, and authorized dynamic testing for the actual sources and sinks.

Run a Security Audit

Frequently Asked Questions

Does CSP prevent all XSS attacks?
No. A well-designed strict CSP can block many script-injection paths, but policy bypasses, unsafe trusted scripts, non-script injection effects, and unsupported clients remain possible. Fix the source or sink and use CSP as defense-in-depth.
Are modern JavaScript frameworks immune to XSS?
Frameworks like React and Angular auto-escape output by default, making accidental XSS much harder. However, they all have escape hatches (like React's dangerouslySetInnerHTML) that bypass protections. Developers must still be careful with these APIs.

Related Terms

Content Security Policy Nonce-Based Content Security Policy strict-dynamic CSP Directive X-XSS-Protection Security Headers Overview
Disclaimer: DomainOptic provides automated informational scans only. Results do not constitute professional security advice, compliance certification, or a guarantee of security. Always verify findings independently.