Cross-site scripting (XSS)

XSS is classified by where the payload lives and where it is turned into code. Reflected XSS echoes input from the current request (a search term, an error parameter) back into the response. Stored XSS persists the payload in the application's data (comments, profile fields, support tickets) and serves it to every viewer, which is why it scales best for the attacker; the 2005 Samy worm on MySpace spread to over a million profiles this way. DOM-based XSS never touches the server's HTML: client-side JavaScript reads an attacker-controlled source such as location.hash or postMessage data and writes it into a dangerous sink such as innerHTML, document.write, eval or a javascript: URL. Mutation XSS (mXSS) exploits the difference between how a sanitizer parses markup and how the browser re-parses it after serialisation.

The root defence is contextual output encoding: the same value needs different escaping in an HTML body, a quoted attribute, a JavaScript string, a CSS value or a URL, and HTML-entity encoding is not sufficient inside a script block or an event-handler attribute. Modern template engines and frameworks (React JSX, Angular, Razor, Thymeleaf) auto-escape by default, so real-world XSS concentrates in escape hatches such as dangerouslySetInnerHTML, bypassSecurityTrustHtml, v-html and raw string templates. When rich HTML must be accepted, it goes through an allowlist sanitizer such as DOMPurify rather than a hand-written regex.

Content Security Policy is the main defence-in-depth layer. A strict CSP uses per-response nonces or hashes with 'strict-dynamic' and disallows inline event handlers, which blocks most injected scripts even when encoding has failed; domain allowlists are routinely bypassed through JSONP endpoints and script gadgets on allowed CDNs. Trusted Types, first shipped in Chromium-based browsers, make DOM sinks reject plain strings, which turns DOM XSS into a type error. HttpOnly cookies stop script from reading the session cookie but do not stop the script from making authenticated requests on the victim's behalf, so they limit rather than prevent the damage.

XSS is catalogued as CWE-79. It was its own OWASP Top 10 category until 2017 (A7), was merged into Injection in 2021 (A03) and remains under Injection as A05 in the 2025 edition. Input validation helps with narrowly typed fields, but it cannot be the primary control, because many legitimate values (names such as O'Brien, free text, markup in a CMS) contain the characters that matter in some output context.