How Cross-Site Scripting Works
How a comment can run code in your users' browsers, and how escaping and CSP stop it
What you'll learn
- How injected script tags run as part of your site
- Stored vs reflected XSS
- Escaping output, and how frameworks do it for you
- Content Security Policy and HttpOnly cookies
In this video, we'll look at cross-site scripting (XSS), starting with the 2005 Samy worm that added a million MySpace friends in less than a day. Using a blog with comments, we'll see how a script tag saved as a comment ends up running in every visitor's browser as part of your site.
We'll cover what that injected code can do, the difference between stored and reflected XSS, and the main fix: escaping user text before it goes into the page, which most frameworks do for you. We'll also look at Content Security Policy and HttpOnly cookies as extra layers.
By the end, you'll know where XSS bugs come from and the layers that keep them out.
