# Cross-Site Scripting (XSS)

## Overview

Cross-site scripting (XSS) is a vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. Cross-site scripting works by manipulating a vulnerable website so that it returns malicious JavaScript to users. When malicious code executes inside a victim's browser, an attacker can fully compromise their interaction with the application.

You can find more details at [PortSwigger Web Security Academy: Cross-site scripting](https://portswigger.net/web-security/cross-site-scripting).

This page contains recommendations for the implementation of protection against Cross-Site Scripting (XSS) attacks.

## General

<div align="left"><img src="/files/QJuMWI21M60ZKzo0mFAN" alt=""></div>

* Make sure all variables go through input validation and are then escaped or sanitized.
* Implement input validation, see the [Input Validation](/application-security-handbook/web-application/input-validation.md) page.
* Implement output encoding, see the [Output Encoding](/application-security-handbook/web-application/output-encoding.md) page.
* Implement HTML sanitization, see [DOMPurify](https://github.com/cure53/DOMPurify).
* Comply with requirements from the [Cookie Security](/application-security-handbook/web-application/cookie-security.md) page.
* Enforce strict Content Security Policy, see the [Content Security Policy (CSP)](/application-security-handbook/web-application/content-security-policy-csp.md) page.

<div align="left"><img src="/files/P0T6i9QsRZT0gGQKpPIC" alt=""></div>

* Use stable versions of modern JavaScript frameworks such as Angular, Vue or React and their protection mechanisms.

## References

* [OWASP Cheat Sheet Series: Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://0xn3va.gitbook.io/application-security-handbook/web-application/vulnerability-mitigation/cross-site-scripting-xss.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.