Cross-site scripting attack
Cross-site scripting is a web security vulnerability in which attacker-controlled content causes executable script to run in another user’s browser within a trusted application context.
The Well-Grounded Python Developer: How the pros use Python and Flask
Cross-site scripting is a web security attack in which injected script content executes in another user's browser.
- How it is used
- Frames a security risk when a blog accepts user-written posts or comments and displays them to other visitors.
- How deep it goes
- Defines the attack through a stored-script scenario and shows a form-filter defense, without detailing browser execution internals.
- Examples
- Uses a blog post containing an embedded script and a post-content field configured with a sanitizing filter.
- What you can do after
- Apply it via Bleach by filtering user-entered form text before it is saved.
Grokking Web Application Security
Cross-site scripting (XSS) is a web vulnerability in which attacker-controlled script code is injected into content rendered for other users.
- How it is used
- Protects users of trusted web applications from attacker-supplied JavaScript running in their browsers.
- How deep it goes
- Explains the request-to-rendering attack path, stored XSS, concrete consequences, HTML escaping, template behavior, and CSP.
- Examples
- Uses a malicious comment, script-tag rendering, cookie redirection, and a stored-comment scenario to demonstrate the attack.
- What you can do after
- Apply output escaping for dynamic HTML and set a Content Security Policy to protect users against XSS.
Read how Grokking Web Application Security explains cross-site scripting attack →
ASP.NET Core in Action, 3e
Cross-site scripting is a web security vulnerability in which attacker-controlled content is injected into pages and executed in a victim's browser.
- How it is used
- Protects web applications and users from injected JavaScript during page rendering.
- How deep it goes
- Explains the attack flow, Razor's automatic encoding, raw output, and context-specific HTML versus JavaScript encoding.
- Examples
- Uses submitted names, @Html.Raw(), Razor expressions, JavaScriptEncoder, script variables, and HTML data attributes.
- What you can do after
- Apply it via Razor Pages by encoding unsafe output and selecting HTML or JavaScript encoding for each rendering context.
Read how ASP.NET Core in Action, 3e explains cross-site scripting attack →
Related concepts
- Content-Security-Policyaddressed by · Content Security Policy is a web security standard that lets a site specify browser-enforced rules restricting the sources and forms of content a document may load or execute.
- injection attackkind of · An injection attack is a security attack in which crafted or untrusted input is interpreted as commands, code, or query structure by a target system.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.