What Is Cross-site Scripting?

Cross-site scripting (XSS) is a class of web application security vulnerability in which an attacker injects malicious client-side code, typically JavaScript, into web pages that are subsequently served to other users. The injected script executes in the victim's browser under the trust context of the vulnerable site, allowing the attacker to steal session credentials, impersonate the user, modify page content, or redirect the browser to a malicious destination. XSS is consistently listed among the most prevalent and consequential vulnerabilities in web security, appearing on the OWASP Top Ten list of critical web application risks.

The vulnerability arises from the fundamental architecture of the web browser, which cannot independently distinguish between scripts delivered as part of a legitimate page and scripts introduced by an attacker through unvalidated input. When a web application accepts data from an untrusted source and includes it in the HTML output without proper encoding or validation, the browser renders that data as executable code rather than as inert text.

Types of XSS Attacks

XSS attacks fall into three principal categories distinguished by how the malicious payload reaches the victim. Reflected XSS occurs when user-supplied input is immediately returned in the server's response without sanitization, for example in an error message or search result page; the attacker typically delivers the attack through a crafted URL sent by email or posted in a forum. Stored XSS, also called persistent XSS, occurs when the attacker's payload is saved to the server's database or file system and subsequently rendered to any user who visits the affected page; comment fields, message boards, and user profile pages are common vectors. DOM-based XSS is a client-side variant in which the payload never reaches the server; instead, the attack exploits JavaScript code in the victim's own browser that reads attacker-controlled data from the DOM environment and writes it back to the page without encoding.

Injection Mechanics and Browser Trust

The exploitability of XSS depends on how browsers enforce the same-origin policy (SOP), the security mechanism that restricts scripts from accessing resources belonging to a different origin. Because the injected script executes within the origin of the vulnerable site, it operates with the same privileges as any legitimate script on that page. This allows the script to read the document.cookie object, access local storage, issue authenticated HTTP requests, and manipulate the DOM. The impact is amplified in single-page applications built with frameworks such as React or Angular, where client-side routing and dynamic DOM construction introduce additional XSS surface area that developers must explicitly address. The PortSwigger Web Security Academy documentation on cross-site scripting provides a detailed technical treatment of how browser parsers handle injected HTML and how context determines the applicable encoding rules.

Prevention and Defense

Defending against XSS requires output encoding applied at the point where untrusted data is inserted into an HTML context, not at the point of input. The encoding strategy must match the syntactic context: HTML entity encoding for HTML content, JavaScript string escaping for inline script data, and URL encoding for query parameters. The OWASP XSS Prevention Cheat Sheet formalizes these rules into context-specific encoding requirements. Content Security Policy (CSP), a browser security feature defined in a W3C specification, allows a server to declare which script sources are permitted, blocking execution of injected inline scripts even when encoding fails. Frameworks that adopt template engines with auto-escaping by default, such as Jinja2 or React's JSX, substantially reduce XSS exposure relative to string concatenation approaches. Security testing through automated scanners and manual penetration testing is recommended to verify that deployed mitigations are effective across the full range of input sinks in an application.

Applications

Cross-site scripting has applications in a range of fields, including:

• Web application security assessment and penetration testing
• Secure software development lifecycle (SDLC) training and tooling
• Browser security policy enforcement and Content Security Policy deployment
• Bug bounty programs and responsible vulnerability disclosure
• Security information and event management (SIEM) alerting on XSS indicators