Lion Cipher Lab
Understand cross-site scripting (XSS) — and how to stop it
- AppSec / DevSecOps
- Beginner
- ~40 min
- Free · no account required
Why it matters
Cross-site scripting is one of the most common and consequential web vulnerabilities: it lets an attacker run their JavaScript in another user's browser, in the context of a site the victim trusts — which can steal session cookies, capture keystrokes, or act as the user. It sits in the OWASP Top 10 under Injection for good reason. But XSS is also very preventable once you understand its single root cause (untrusted data ending up in a page where the browser treats it as code) and the fixes that address that cause (encoding output, a good Content-Security-Policy, and modern frameworks that…
What you'll learn
- what XSS is and its three types
- why untrusted input in a page is dangerous
- output encoding as the primary fix
- Content-Security-Policy as defense in depth
- trusting framework auto-escaping
Steps in this lab
- What XSS is, in one idea
- The three kinds, briefly
- See it once, safely, on your own app
- The primary fix: encode output for its context
- Let your framework do the escaping — and don't defeat it
- Add Content-Security-Policy as a safety net
- Why defenders should know the attack