LearnViz CompSci
Home / Learn / Security & Cryptography / Cross-Site Scripting

Intermediate Topic 25 of 51 Security & Cryptography

Cross-Site Scripting

Attack injecting script into pages seen by others.

How it works

Cross-site scripting happens when an application includes untrusted data in a page without proper encoding, so an attacker's script executes in a victim's browser within the site's origin. Types are stored, where the payload is saved on the server, reflected, where it comes from the request, and DOM-based, where client-side code writes it into the page. A script can steal session data, perform actions as the user or rewrite the page.

Step-by-step walkthrough

  1. The attacker posts a comment containing a script.
  2. The site stores it unescaped.
  3. A victim loads the page.
  4. The script runs in the victim's browser with the site's privileges.
  5. It can steal cookies, so escape output and use a content security policy.

Where it is used

Every website displaying user content, such as comments, profiles and search results, must defend against XSS with context-aware output encoding, safe templating frameworks and sanitizing any allowed HTML.

Common pitfall

Using innerHTML or dangerouslySetInnerHTML with user data, building URLs with javascript: schemes and trusting client-side filtering are typical failures. Encoding must match the context: HTML, attribute, JavaScript or URL. Add Content Security Policy, HttpOnly cookies and Trusted Types as defense in depth.

Where it fits in the course

Cross-Site Scripting is topic 25 of 51 in Security & Cryptography, rated Intermediate. It follows SQL Injection. The next topic is CSRF.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is Cross-Site Scripting?
Attack injecting script into pages seen by others. It belongs to Security & Cryptography and is an intermediate-level topic.
Where do people use Cross-Site Scripting?
Every website displaying user content, such as comments, profiles and search results, must defend against XSS with context-aware output encoding, safe templating frameworks and sanitizing any allowed HTML.
What is the most common mistake with Cross-Site Scripting?
Using innerHTML or dangerouslySetInnerHTML with user data, building URLs with javascript: schemes and trusting client-side filtering are typical failures.
What should I learn before this topic?
Start with SQL Injection, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is Cross-Site Scripting hard to learn?
It is an Intermediate topic. Be comfortable with the Beginner topics in this area first, then read the common pitfall carefully, since it is where most mistakes happen.
How long does it take to learn Cross-Site Scripting?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to Cross-Site Scripting?
SQL Injection, CSRF, Message Authentication Codes are closely connected. The full list is in the related topics section of this page.
What should I study after Cross-Site Scripting?
Continue with CSRF, the next topic in Security & Cryptography.

Related topics