# Cross-site scripting

> Sneaking code into a website so it runs in other visitors' browsers.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/cross-site-scripting/
- In Spanish: [Cross-site scripting](https://tidbit.legios.com.ar/es/cross-site-scripting/)

Websites constantly show text that someone else wrote: comments, product reviews, usernames, the words you searched for. **Cross-site scripting**, almost always called **XSS**, happens when a site shows that text without making sure it stays text. If an attacker writes a comment that contains a bit of JavaScript disguised inside HTML, and the site pastes it into the page as is, every visitor's web browser reads it as part of the page and runs it.

That code runs with the site's own identity. It can read what the page shows, act as the logged-in visitor (post, change settings, send messages), show a fake login box, or grab session cookies so the attacker can take over the account. The visitor did nothing wrong: they opened a trusted site. The flaw is in the site, which let an outsider's code into its pages.

There are a few versions. **Stored** XSS lives in the site's database, like the comment above, and hits everyone who views it. **Reflected** XSS bounces off a link: the malicious bit is in the URL and the page echoes it back to whoever clicks. **DOM-based** XSS happens entirely inside the browser, in the site's own JavaScript.

The defenses are well known. Developers **escape** or encode anything that came from outside before putting it in a page, so `<` shows up as the character instead of starting a tag; modern frameworks do this automatically. A **Content Security Policy** tells the browser which scripts the site actually expects, and marking session cookies as `HttpOnly` keeps scripts from reading them. OWASP's guidance covers all of this in detail.

## An analogy

A community bulletin board where the person in charge reads every note aloud to the room. If someone pins up a note saying 'everyone, hand your house keys to the person by the door', a careless reader announces it as if it were official. A good reader says 'this note says…' and never treats it as an order.

## Keep in mind

- XSS puts an attacker's script into a trusted page, run by other visitors.
- The script acts with the visitor's session on that site.
- Stored, reflected and DOM-based are the three main variants.
- Escaping output, Content Security Policy and HttpOnly cookies are the main defenses.

## Go deeper

- [Cross Site Scripting (OWASP)](https://owasp.org/www-community/attacks/xss/)
- [Cross-site scripting (MDN)](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS)
- [Cross-site scripting on Wikipedia](https://en.wikipedia.org/wiki/Cross-site_scripting)

## Related terms

- [JavaScript](https://tidbit.legios.com.ar/javascript/): The programming language that runs inside web pages and makes them interactive.
- [HTML](https://tidbit.legios.com.ar/html/): The text format that describes what is on a web page: headings, paragraphs, links.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.
- [Cookies](https://tidbit.legios.com.ar/cookies/): Small notes a website asks your browser to keep, so it can recognize you later.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [URL](https://tidbit.legios.com.ar/url/): The full address of something on the web: protocol, site and path.
- [Framework](https://tidbit.legios.com.ar/framework/): A ready-made skeleton for an app: it sets the structure and calls your code.