What is XSS (Cross-Site Scripting)?

An attack where attacker-controlled JavaScript executes in another user's browser in the context of your application.

Full explanation

XSS comes in three flavors: stored (malicious script saved in your DB and served to other users), reflected (script in a URL parameter echoed back), and DOM-based (client-side JS unsafely handles URL params or innerHTML). Consequences include session theft, credential harvesting, and arbitrary actions in the victim's session. Modern frameworks (React, Vue, Svelte) escape by default but `dangerouslySetInnerHTML`, `v-html`, and similar opt-outs re-introduce XSS.

Example

A user bio field stores HTML. Another user visits the profile; the browser executes whatever HTML (including `<script>`) was in the bio.

Related

FAQ

Does CSP prevent XSS?

A strict CSP prevents most XSS exploitation (can still be exploited via data exfiltration or layout tricks but not full script execution). CSP is defense in depth; proper input escaping is the primary defense.