Editing Cross-site scripting

{{Short description|Security issue for web applications}}{{Use mdy dates|date=June 2019}}{{Redirect|XSS}}
'''Cross-site scripting''' ('''XSS'''){{Efn|The abbreviation 'XSS' is commonly used to avoid confusion with [[cascading style sheets]].}} is a type of security [[vulnerability (computer science)|vulnerability]] that can be found in some [[web application]]s. XSS attacks enable attackers to [[code injection|inject]] client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass [[access control]]s such as the [[same-origin policy]]. During the second half of 2007, XSSed documented 11,253 site-specific cross-site vulnerabilities, compared to 2,134 "traditional" vulnerabilities documented by [[NortonLifeLock|Symantec]].<ref name=SIS_1>{{cite web| title=Symantec Internet Security Threat Report: Trends for July–December 2007 (Executive Summary)| url=https://techcrunch.com/wp-content/uploads/2009/08/b-whitepaper_exec_summary_internet_security_threat_report_xiii_04-2008.en-us.pdf| publisher=[[Yahoo]]| volume=XIII |pages=1–3|date=April 2008| access-date=1 January 2024| url-status=live| archive-date=25 June 2008| archive-url=https://web.archive.org/web/20080625065121/https://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_exec_summary_internet_security_threat_report_xiii_04-2008.en-us.pdf}}</ref> XSS effects vary in 
range from petty nuisance to significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner [[Computer network|network]].

[[OWASP]] considers the term cross-site scripting to be a [[misnomer]]. It initially was an attack that was used for breaching data across sites, but gradually started to include other forms of data injection attacks.<ref>{{Cite web |title=Cross Site Scripting Prevention - OWASP Cheat  SheetSeries|url=https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html |access-date=2003-03-19 |website=[[OWASP]]}}</ref>

==Background==
{{Main|Web security|Same-origin policy}}
Security on the web depends on a variety of mechanisms, including an underlying concept of trust known as the [[same-origin policy]]. This states that if content from one site (such as ''<nowiki>https://mybank.example1.com</nowiki>'') is granted permission to access resources (like cookies etc.) on a web browser, then content from any URL with the same (1) [[URI scheme]] (e.g. ftp, http, or https), (2) [[host name]], ''and'' (3) [[port number]] will share these permissions. Content from URLs where any of these three attributes are different will have to be granted permissions separately.<ref>{{cite web |title= Same Origin Policy - Web Security. W3.org. |url= http://www.w3.org/Security/wiki/Same_Origin_Policy |access-date= November 4, 2014 }}</ref>

Cross-site scripting attacks use known vulnerabilities in [[Web application|web-based applications]], their [[Server (computing)|servers]], or the plug-in systems on which they rely. Exploiting one of these, attackers fold malicious content into the content being delivered from the compromised site. When the resulting combined content arrives at the client-side web browser, it has all been delivered from the trusted source, and thus operates under the permissions granted to that system. By finding ways of injecting malicious scripts into web pages, an attacker can gain elevated access-privileges to sensitive page content, to session cookies, and to a variety of other information maintained by the browser on behalf of the user. Cross-site scripting attacks are a case of [[code injection]].

[[Microsoft]] security-engineers introduced the term "cross-site scripting" in January 2000.<ref name="xssname">{{cite web |author= "dross" on MSDN |title= Happy 10th birthday Cross-Site Scripting! |url= https://learn.microsoft.com/en-ca/archive/blogs/dross/happy-10th-birthday-cross-site-scripting |date=15 Dec 2009 |access-date= 2023-02-09| quote = On the 16th of January, 2000, the following names were suggested and bounced around among a small group of Microsoft security engineers: [...] The next day there was consensus – Cross Site Scripting. }}</ref>{{Non-primary source needed|date=October 2024}} The expression "cross-site scripting" originally referred to the act of loading the attacked, third-party web application from an unrelated attack-site, in a manner that executes a fragment of JavaScript prepared by the attacker in the [[same-origin policy|security context]] of the targeted domain (taking advantage of a ''reflected'' or ''non-persistent'' XSS vulnerability). The definition gradually expanded to encompass other modes of code injection, including persistent and non-JavaScript vectors (including [[ActiveX]], [[Java (programming language)|Java]], [[VBScript]], [[Adobe Flash|Flash]], or even [[HTML]] scripts), causing some confusion to newcomers to the field of [[information security]].<ref name="Grossman">{{cite web |last= Grossman |first= Jeremiah |title= The origins of Cross-Site Scripting (XSS) |url= http://jeremiahgrossman.blogspot.com/2006/07/origins-of-cross-site-scripting-xss.html |date= July 30, 2006 |access-date= September 15, 2008 }}</ref>

XSS vulnerabilities have been reported and exploited since the 1990s. Prominent sites affected in the past include the social-networking sites [[Twitter]]<ref>{{cite news |last= Arthur |first= Charles |title= Twitter users including Sarah Brown hit by malicious hacker attack |url= https://www.theguardian.com/technology/blog/2010/sep/21/twitter-bug-malicious-exploit-xss |date= September 21, 2010 |newspaper= The Guardian |access-date= September 21, 2010 }}</ref> and 
[[Facebook]].<ref>{{cite web |last= Leyden |first= John |title= Facebook poked by XSS flaw |url= https://www.theregister.co.uk/2008/05/23/facebook_xss_flaw/ |date= May 23, 2008 |website= The Register |access-date= May 28, 2008 }}</ref> Cross-site scripting flaws have since surpassed [[buffer overflow]]s to become the most common publicly reported security vulnerability,<ref>{{cite web |last1= Christey |first1= Steve |last2= Martin |first2= Robert A. |title= Vulnerability Type Distributions in CVE (version 1.1) |url= //cwe.mitre.org/documents/vuln-trends/index.html |date= May 22, 2007 |publisher= MITRE Corporation |access-date= June 7, 2008 }}</ref> with some researchers in 2007 estimating as many as 68% of websites are likely open to XSS attacks.<ref>
{{cite news 
|last= Berinato |first= Scott 
|title= Software Vulnerability Disclosure: The Chilling Effect 
|url= http://www.csoonline.com/article/221113 
|archive-url= https://web.archive.org/web/20080418072230/http://www.csoonline.com/article/221113 
|archive-date= April 18, 2008 |work= CSO |page= 7 
|publisher= [[CXO Media]] |date= January 1, 2007 |access-date= June 7, 2008 
}}
</ref>

==Types==
There is no single, standardized classification of cross-site scripting flaws, but most experts distinguish between at least two primary flavors of XSS flaws: ''non-persistent'' and ''persistent''. Some sources further divide these two groups into ''traditional'' (caused by server-side code flaws) and ''[[Document Object Model|DOM]]-based'' (in client-side code).

===Non-persistent (reflected)===
The ''non-persistent'' (or ''reflected'') cross-site scripting vulnerability is by far the most basic type of web vulnerability.<ref name="HopeWalther">{{Cite book |last1=Paco |first1=Hope |last2=Walther |first2=Ben |title=Web Security Testing Cookbook |publisher=O'Reilly Media, Inc. |year=2008 |location=Sebastopol, CA |page=[https://archive.org/details/websecuritytesti00hope/page/128 128] |isbn=978-0-596-51483-9 |url-access=registration |url=https://archive.org/details/websecuritytesti00hope/page/128 }}</ref> These holes show up when the data provided by a web client,<ref>{{Cite journal |last1=Hydara |first1=Isatou |last2=Sultan |first2=Abu Bakar Md. |last3=Zulzalil |first3=Hazura |last4=Admodisastro |first4=Novia |date=2015-02-01 |title=Current state of research on cross-site scripting (XSS) – A systematic literature review |url=https://linkinghub.elsevier.com/retrieve/pii/S0950584914001700 |journal=Information and Software Technology |language=en |volume=58 |pages=170–186 |doi=10.1016/j.infsof.2014.07.010|url-access=subscription }}</ref> most commonly in HTTP query parameters (e.g. HTML form submission), is used immediately by server-side scripts to parse and display a page of results for and to that user, without properly [[HTML sanitization|sanitizing]] the content.<ref name="WASC-2005">{{cite web |title=Cross-site Scripting |url=http://projects.webappsec.org/Cross-Site-Scripting |year=2005 |publisher=Web Application Security Consortium |access-date=May 28, 2008}}</ref>

Because HTML documents have a flat, serial structure that mixes control statements, formatting, and the actual content, any non-validated user-supplied data included in the resulting page without proper HTML encoding, may lead to markup injection.<ref name="HopeWalther" /><ref name="WASC-2005" /> A classic example of a potential vector is a site search engine: if one searches for a string, the search string will typically be redisplayed verbatim on the result page to indicate what was searched for. If this response does not properly [[Escape character|escape]] or reject HTML control characters, a cross-site scripting flaw will ensue.<ref name="GHFPR">{{cite book |last1=Grossman |first1=Jeremiah |first2=Robert |last2=Hansen |first3=Seth |last3=Fogie |first4=Petko D. |last4=Petkov |first5=Anton |last5=Rager |title=XSS Attacks: Cross Site Scripting Exploits and Defense (Abstract) |pages=70, 156 |url=https://books.google.com/books?id=dPhqDe0WHZ8C |year=2007 |publisher=Syngress |isbn=978-1-59749-154-9 |access-date=May 28, 2008}}</ref>

A reflected attack is typically delivered via email or a neutral web site. The bait is an innocent-looking URL, pointing to a trusted site but containing the XSS vector. If the trusted site is vulnerable to the vector, clicking the link can cause the victim's browser to execute the injected script.

===Persistent (or stored)===
The ''persistent'' (or ''stored'') XSS vulnerability is a more devastating variant of a cross-site scripting flaw: it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular browsing, without proper HTML escaping. A classic example of this is with online message boards where users are allowed to post HTML formatted messages for other users to read.<ref name="WASC-2005" />

For example, suppose there is a dating website where members scan the profiles of other members to see if they look interesting.  For privacy reasons, this site hides everybody's real name and email.  These are kept secret on the server.  The only time a member's real name and [[email]] are in the browser is when the member is [[Login|signed in]], and they can't see anyone else's.

Suppose that Mallory, an attacker, joins the site and wants to figure out the real names of the people she sees on the site.  To do so, she writes a script designed to run from other users' browsers when ''they'' visit ''her'' profile.  The script then sends a quick message to her own server, which collects this information.

To do this, for the question "Describe your Ideal First Date", Mallory gives a short answer (to appear normal), but the text at the end of her answer is her script to steal names and emails.  If the script is enclosed inside a <code><script></code> element, it won't be shown on the screen.  Then suppose that Bob, a member of the dating site, reaches Mallory's profile, which has her answer to the First Date question. Her script is run automatically by the browser and steals a copy of Bob's real name and email directly from his own machine.

Persistent XSS vulnerabilities can be more significant than other types because an attacker's malicious script is rendered automatically, without the need to individually target victims or lure them to a third-party website. Particularly in the case of social networking sites, the code would be further designed to self-propagate across accounts, creating a type of client-side [[Computer worm|worm]].<ref>Viruses and worms in {{cite web |last=Alcorn |first=Wade |title=The Cross-site Scripting Virus |date=September 27, 2005 |url=http://www.bindshell.net/papers/xssv |publisher=BindShell.net |access-date=May 27, 2008 |archive-url=https://web.archive.org/web/20080516055612/http://www.bindshell.net/papers/xssv/ |archive-date=May 16, 2008 |url-status=dead |df=mdy-all }} and {{cite web |last=Grossman |first=Jeremiah |title=Cross-Site Scripting Worms and Viruses: The Impending Threat and the Best Defense |url=https://www.helpnetsecurity.com/2006/05/04/cross-site-scripting-worms-and-viruses-the-impending-threat-and-the-best-defense/ |date=November 2020 |publisher=WhiteHat Security |page=20 |access-date=June 6, 2008 }}{{Dead link|date=August 2018 |bot=InternetArchiveBot |fix-attempted=yes }}</ref>

The methods of injection can vary a great deal; in some cases, the attacker may not even need to directly interact with the web functionality itself to exploit such a hole. Any data received by the web application (via email, system logs, IM etc.) that can be controlled by an attacker could become an injection vector.

===Server-side versus DOM-based vulnerabilities===
XSS vulnerabilities were originally found in applications that performed all data processing on the server side. User input (including an XSS vector) would be sent to the server, and then sent back to the user as a web page. The need for an improved user experience resulted in popularity of applications that had a majority of the presentation logic (maybe written in [[JavaScript]]) working on the client-side that pulled data, on-demand, from the server using [[AJAX]].

As the JavaScript code was also processing user input and rendering it in the web page content, a new sub-class of reflected XSS attacks started to appear that was called ''[[Document Object Model|DOM]]-based cross-site scripting''. In a DOM-based XSS attack, the malicious data does not touch the web server. Rather, it is being reflected by the JavaScript code, fully on the client side.<ref>{{cite web |url=https://www.owasp.org/index.php/DOM_Based_XSS |title=DOM based XSS |publisher=OWASP}}</ref>

An example of a DOM-based XSS vulnerability is the bug found in 2011 in a number of [[jQuery]] plugins.<ref>{{cite web |url=http://bugs.jquery.com/ticket/9521 |title=JQuery bug #9521 |year=2011}}</ref> Prevention strategies for DOM-based XSS attacks include very similar measures to traditional XSS prevention strategies but implemented in [[JavaScript]] code and contained in web pages (i.e. input validation and escaping).<ref>{{cite web |url=https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet |title=DOM based XSS prevention cheat sheet |publisher=OWASP}}</ref> Some [[JavaScript library|JavaScript frameworks]] have built-in countermeasures against this and other types of attack &mdash; for example [[AngularJS]].<ref>{{cite web |url=http://docs.angularjs.org/api/ng.$sce |title=Strict Contextual Escaping |publisher=Angular.js}}</ref>

===Self-XSS===
{{Main|Self-XSS}}

[[Self-XSS]] is a form of XSS vulnerability that relies on [[Social engineering (security)|social engineering]] in order to trick the victim into executing malicious JavaScript code in their browser. Although it is technically not a true XSS vulnerability due to the fact it relies on socially engineering a user into executing code rather than a flaw in the affected website allowing an attacker to do so, it still poses the same risks as a regular XSS vulnerability if properly executed.<ref>{{cite web |title= Self-XSS Facebook scam attempts to trick users into hacking themselves |work= www.majorgeeks.com |date= 2014-07-29 |url= http://www.majorgeeks.com/news/story/self_xss_facebook_scam_attempts_to_trick_users_into_hacking_themselves.html |access-date= 2016-09-20 }}</ref>

===Mutated XSS (mXSS) ===
Mutated XSS happens when the attacker injects something that is seemingly safe but is rewritten and modified by the browser while parsing the markup. This makes it extremely hard to detect or sanitize within the website's application logic. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters on parameters to CSS font-family.

== Preventive measures ==
===Contextual output encoding/escaping of string input===

There are several escaping schemes that can be used depending on where the untrusted string needs to be placed within an HTML document including HTML entity encoding, JavaScript escaping, CSS escaping, and [[Percent-encoding|URL (or percent) encoding]].<ref name="OWASP">{{cite web |last=Williams |first=Jeff |title=XSS (Cross Site Scripting) Prevention Cheat Sheet |url=https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet |publisher=OWASP |date=January 19, 2009 |access-date=February 4, 2010 |archive-date=March 18, 2017 |archive-url=https://web.archive.org/web/20170318125710/https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet |url-status=dead }}</ref> Most web applications that do not need to accept rich data can use escaping to largely eliminate the risk of XSS attacks in a fairly straightforward manner.

Performing HTML entity encoding only on the [[List of XML and HTML character entity references#Predefined entities in XML|five XML significant characters]] is not always sufficient to prevent many forms of XSS attacks, security encoding libraries are usually easier to use.<ref name="OWASP" />

Some [[web template system]]s understand the structure of the HTML they produce and automatically pick an appropriate encoder.<ref>{{Cite web|url=https://golang.org/pkg/html/template/#hdr-Introduction|title=template - The Go Programming Language|website=golang.org|access-date=2019-05-01}}</ref><ref>{{Cite web|url=https://www.npmjs.com/package/pug-plugin-trusted-types|title=pug-plugin-trusted-types|website=npm|access-date=2019-05-01}}</ref>

===Safely validating untrusted HTML input ===

Many operators of particular web applications (e.g. forums and webmail) allow users to utilize a limited subset of HTML markup. When accepting HTML input from users (say, <code>&lt;b&gt;very&lt;/b&gt; large</code>), output encoding (such as <code>&amp;lt;b&amp;gt;very&amp;lt;/b&amp;gt; large</code>) will not suffice since the user input needs to be rendered as HTML by the browser (so it shows as "'''very''' large", instead of "&lt;b&gt;very&lt;/b&gt; large"). Stopping an XSS attack when accepting HTML input from users is much more complex in this situation. Untrusted HTML input must be run through an [[HTML sanitization]] engine to ensure that it does not contain XSS code.

Many validations rely on parsing out (blacklisting) specific "at risk" HTML tags such as the [[IFRAME|iframe tag]], link and the script tag.

There are several issues with this approach, for example sometimes seemingly harmless tags can be left out which when utilized correctly can still result in an XSS

Another popular method is to strip user input of " and ' however this can also be bypassed as the payload can be concealed with [[obfuscation]].

===Cookie security===
{{Further information|HTTP cookie}}
Besides content filtering, other imperfect methods for cross-site scripting mitigation are also commonly used. One example is the use of additional security controls when handling [[HTTP cookie|cookie]]-based user authentication. Many web applications rely on session cookies for authentication between individual HTTP requests, and because client-side scripts generally have access to these cookies, simple XSS exploits can steal these cookies.<ref name="Sharma">{{cite web |last=Sharma |first=Anand |title=Prevent a cross-site scripting attack |url=http://www.ibm.com/developerworks/ibm/library/wa-secxss/ |publisher=IBM |date=February 3, 2004 |access-date=May 29, 2008 }}</ref> To mitigate this particular threat (though not the XSS problem in general), many web applications tie session cookies to the IP address of the user who originally logged in, then only permit that IP to use that cookie.<ref name="ModSecurity">{{cite web |title=ModSecurity: Features: PDF Universal XSS Protection |url=http://www.modsecurity.org/projects/modsecurity/apache/feature_universal_pdf_xss.html |archive-url=https://web.archive.org/web/20080323040609/http://www.modsecurity.org/projects/modsecurity/apache/feature_universal_pdf_xss.html |url-status=dead |archive-date=March 23, 2008 |publisher=Breach Security |access-date=June 6, 2008 }}</ref> This is effective in most situations (if an attacker is only after the cookie), but obviously breaks down in situations where an attacker is behind the same [[Network address translation|NAT]]ed IP address or [[web proxy]] as the victim, or the victim is changing his or her [[mobile IP]].<ref name="ModSecurity" />

====Http-only cookie====
{{Main|Http-only cookie}}

Another mitigation present in [[Internet Explorer]] (since version 6), [[Firefox]] (since version 2.0.0.5), [[Safari (web browser)|Safari]] (since version 4), [[Opera (web browser)|Opera]] (since version 9.5) and [[Google Chrome]], is an ''HttpOnly'' flag which allows a web server to set a cookie that is unavailable to client-side scripts. While beneficial, the feature can neither fully prevent cookie theft nor prevent attacks within the browser.<ref>{{cite web |title=Ajax and Mashup Security |url=http://www.openajax.org/whitepapers/Ajax%20and%20Mashup%20Security.php |publisher=OpenAjax Alliance |access-date=June 9, 2008 |url-status=dead |archive-url=https://web.archive.org/web/20080403234132/http://www.openajax.org/whitepapers/Ajax%20and%20Mashup%20Security.php |archive-date=April 3, 2008 |df=mdy-all }}</ref>

===Disabling scripts===

While [[Web 2.0]] and [[Ajax (programming)|Ajax]] developers require the use of JavaScript,<ref>{{cite web |last=O'Reilly |first=Tim |title=What Is Web 2.0 |url=http://oreilly.com/web2/archive/what-is-web-20.html |pages=4–5 |date=September 30, 2005 |publisher=O'Reilly Media |access-date=June 4, 2008 }}</ref> some web applications are written to allow operation without the need for any client-side scripts.<ref>"A page should work, even if in a degraded form, without JavaScript." in {{cite book |last=Zammetti |first=Frank |title=Practical JavaScript, DOM Scripting and Ajax Projects via Amazon Reader |url=https://www.amazon.com/gp/reader/1590598164/ |publisher=Apress |page=36 |isbn=978-1-59059-816-0 |date=April 16, 2007 |access-date=June 4, 2008 }}</ref> This allows users, if they choose, to disable scripting in their browsers before using the application. In this way, even potentially malicious client-side scripts could be inserted unescaped on a page, and users would not be susceptible to XSS attacks.

Some browsers or browser plugins can be configured to disable client-side scripts on a per-domain basis. This approach is of limited value if scripting is allowed by default, since it blocks bad sites only ''after'' the user knows that they are bad, which is too late.  Functionality that blocks all scripting and external inclusions by default and then allows the user to enable it on a per-domain basis is more effective. This has been possible for a long time in Internet Explorer (since version 4) by setting up its so called "Security Zones",<ref>{{cite web |title=How to use security zones in Internet Explorer |url=http://support.microsoft.com/kb/174360/en-us |date=December 18, 2007 |publisher=Microsoft |access-date=June 4, 2008 }}</ref> and in Opera (since version 9) using its "Site Specific Preferences".<ref>{{cite web |first=Håkon Wium |last=Lie |title=Opera 9 Technology Preview 2 |url=http://labs.opera.com/news/2006/02/07-2/ |date=February 7, 2006 |publisher=Opera Software |access-date=June 4, 2008 |archive-url=https://web.archive.org/web/20080517034438/http://labs.opera.com/news/2006/02/07-2/ |archive-date=May 17, 2008 |url-status=dead |df=mdy-all }}</ref> A solution for Firefox and other [[Gecko (layout engine)|Gecko]]-based browsers is the open source [[NoScript]] add-on which, in addition to the ability to enable scripts on a per-domain basis, provides some XSS protection even when scripts are enabled.<ref>{{cite web |title=NoScript |url=https://addons.mozilla.org/en-US/firefox/addon/noscript/ |publisher=Mozilla |date=May 30, 2008 |access-date=June 4, 2008 }} and {{cite news |last=Mogull |first=Rich |title=Should Mac Users Run Antivirus Software? |url=http://db.tidbits.com/article/9511 |date=March 18, 2008 |work=TidBITS |publisher=TidBITS Publishing |access-date=June 4, 2008 }}</ref>

The most significant problem with blocking all scripts on all websites by default is substantial reduction in functionality and responsiveness (client-side scripting can be much faster than server-side scripting because it does not need to connect to a remote server and the page or [[Frame (World Wide Web)|frame]] does not need to be reloaded).<ref>{{cite web |title="Using client-side events" in DataWindow Programmer's Guide |url=http://www.elsevier.com/homepage/saa/trac/progmeth.htm |date=March 2003 |publisher=Sybase |access-date=June 4, 2008 |archive-url=https://web.archive.org/web/20080618005734/http://www1.elsevier.com/homepage/saa/trac/progmeth.htm |archive-date=June 18, 2008 |url-status=dead |df=mdy-all }}</ref> Another problem with script blocking is that many users do not understand it, and do not know how to properly secure their browsers. Yet another drawback is that many sites do not work without client-side scripting, forcing users to disable protection for that site and opening their systems to vulnerabilities.<ref>73% of sites relied on JavaScript in late 2006, in {{cite news |title='Most websites' failing disabled |url=http://news.bbc.co.uk/2/hi/technology/6210068.stm |work=BBC News |date=December 6, 2006 |access-date=June 4, 2008 }}</ref> The Firefox NoScript extension enables users to allow scripts selectively from a given page while disallowing others on the same page. For example, scripts from example.com could be allowed, while scripts from advertisingagency.com that are attempting to run on the same page could be disallowed.<ref>{{cite web |title=NoScript Features |url=http://noscript.net/features |access-date=March 7, 2009 }}</ref>

=== Selectively disabling scripts ===

====Content Security Policy====
{{Main|Content Security Policy}}

[[Content Security Policy]] (CSP) allows HTML documents to opt in to disabling some scripts while leaving others enabled.<ref>{{Cite web|url=https://www.w3.org/TR/CSP3/Overview.html|title=Content Security Policy Level 3|website=www.w3.org|access-date=2019-05-01}}</ref> The browser checks each script against a policy before deciding whether to run it. As long as the policy only allows trustworthy scripts and disallows [[Eval|dynamic code loading]], the browser will not run programs from untrusted authors regardless of the HTML document's structure.

Modern CSP policies allow using [[Cryptographic nonce|nonces]] to mark scripts in the HTML document as safe to run instead of keeping the policy entirely separate from the page content.<ref>{{Cite web|url=https://caniuse.com/#feat=contentsecuritypolicy2|title=Can I use... Support tables for HTML5, CSS3, etc|website=caniuse.com|access-date=2019-05-01}}</ref><ref>{{Cite web|url=https://csp.withgoogle.com/docs/strict-csp.html|title=Strict CSP - Content Security Policy|website=csp.withgoogle.com|access-date=2019-05-01}}</ref> As long as trusted nonces only appear on trustworthy scripts, the browser will not run programs from untrusted authors. Some large application providers report having successfully deployed nonce-based policies.<ref>{{Cite web|url=https://www.eweek.com/security/how-google-is-using-content-security-policy-to-mitigate-web-flaws|title=How Google Is Using Content Security Policy to Mitigate Web Flaws|website=eWEEK|date=April 22, 2019 |access-date=2019-05-01}}</ref><ref name=OR_1>{{cite web| title=[CSP] On Reporting and Filtering| last=Akhawe| first=Devdatta| url=https://dropbox.tech/security/on-csp-reporting-and-filtering| publisher=[[Dropbox]]| date=21 September 2015| access-date=1 January 2024}}</ref>

===Emerging defensive technologies===
Trusted types<ref>{{Cite web|url=https://wicg.github.io/trusted-types/dist/spec/|title=Trusted Types Spec WIP|website=wicg.github.io|access-date=2019-05-01}}</ref> changes [[Web API]]s to check that values have been [[Trademark (computer security)|trademarked]] as trusted. &nbsp;As long as programs only trademark trustworthy values, an attacker who controls a JavaScript [[String (computer science)|string value]] cannot cause XSS. &nbsp;Trusted types are designed to be [[Information security audit|auditable]] by [[Blue team (computer security)|blue teams]].

Another defense approach is to use automated tools that will remove XSS malicious code in web pages, these tools use [[static program analysis|static analysis]] and/or pattern matching methods to identify malicious codes potentially and secure them using methods like escaping.<ref>L. K. Shar and H. B. K. Tan, "Automated removal of cross site scripting vulnerabilities in web applications,"  ''Information and Software Technology,'' vol. 54, ''(5),'' pp. 467-478, 2012.</ref>

===SameSite cookie parameter===
{{Main|Same-site cookie}}

When a cookie is set with the <code>SameSite=Strict</code> parameter, it is stripped from all cross-origin requests. When set with <code>SameSite=Lax</code>, it is stripped from all non-"safe" cross-origin requests (that is, requests other than GET, OPTIONS, and TRACE which have read-only semantics).<ref>{{Cite journal|url=https://tools.ietf.org/html/draft-west-first-party-cookies-07|title=Same-site Cookies|last1=Mark|first1=Goodwin|last2=Mike|first2=West|website=tools.ietf.org|date=April 6, 2016 |language=en|access-date=2018-05-04}}</ref> The feature is implemented in [[Google Chrome]] since version 63 and [[Firefox]] since version 60.<ref>{{Cite web|url=https://caniuse.com/#feat=same-site-cookie-attribute|title=Can I use... Support tables for HTML5, CSS3, etc|website=caniuse.com|language=en-US|access-date=2018-05-04}}</ref>

== Notable Incidents ==

* [[British Airways data breach]] (2018)

== See also ==
*[[Web application security]] 
*[[Internet security]] 
*[[XML external entity]]
*[[Browser security]] 
*[[Metasploit Project]], an open-source penetration testing tool that includes tests for XSS
*[[w3af]], an open-source [[web application security scanner]]
*DOMPurify, a [[free and open source]] code library by [[Cure53]] to reduce susceptibility to XSS vulnerabilities in websites.
*[[Cross-document messaging]]
*[[Samy (computer worm)]]
*[[Parameter validation]]

== Footnotes ==
{{Notelist}}

==References==
{{Reflist|30em}}

==Further reading==
*{{cite web | last=MacKenzie | first=Thomas | title= ScriptAlert1.com&nbsp;– Concise Cross-Site Scripting Explanation in Multiple Languages | url=http://www.scriptalert1.com | access-date=2015-10-24}}
*{{cite web | title=Preventing XSS in ASP.NET Made Easy | website=Lock Me Down &#124; Security for the Everyday Developer | date=2015-02-06 | url=http://lockmedown.com/preventing-xss-in-asp-net-made-easy/ | access-date=2015-10-24}}
*{{cite web | title=Cross Site Scripting | website=The Web Application Security Consortium | date=2005-10-13 | url=http://projects.webappsec.org/Cross-Site-Scripting | access-date=2015-10-24}}

==External links==
*[[OWASP]]: [https://owasp.org/www-community/attacks/xss/ XSS], [http://www.owasp.org/index.php/Testing_for_Cross_site_scripting Testing for XSS], [http://www.owasp.org/index.php/Reviewing_Code_for_Cross-site_scripting Reviewing Code for XSS]
*[http://www.xssed.com/ XSSed: Database of Websites Vulnerable to Cross-Site Scripting Attacks]

{{Web interfaces}}
{{Information security}}


{{DEFAULTSORT:Cross-Site Scripting}}
[[Category:Web security exploits]]
[[Category:Injection exploits]]
[[Category:Hacking (computer security)]]
[[Category:Client-side web security exploits]]