Lesson 2.119mIntermediate11.2k students
Cross-site scripting (XSS)
XSS is attacker-controlled content executing as script in your page. Contextual output encoding is the fix; blocklists are not.
This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will
- Tell stored, reflected, and DOM-based XSS apart
- Encode output for the context it lands in
- Constrain script sources with a content security policy
Resources
Your notes for this lesson will appear here.