> For the complete documentation index, see [llms.txt](https://0xn3va.gitbook.io/application-security-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xn3va.gitbook.io/application-security-handbook/web-application/vulnerability-mitigation/cross-site-scripting-xss.md).

# Cross-Site Scripting (XSS)

## Overview

Cross-site scripting (XSS) is a vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. Cross-site scripting works by manipulating a vulnerable website so that it returns malicious JavaScript to users. When malicious code executes inside a victim's browser, an attacker can fully compromise their interaction with the application.

You can find more details at [PortSwigger Web Security Academy: Cross-site scripting](https://portswigger.net/web-security/cross-site-scripting).

This page contains recommendations for the implementation of protection against Cross-Site Scripting (XSS) attacks.

## General

<div align="left"><img src="/files/QJuMWI21M60ZKzo0mFAN" alt=""></div>

* Make sure all variables go through input validation and are then escaped or sanitized.
* Implement input validation, see the [Input Validation](/application-security-handbook/web-application/input-validation.md) page.
* Implement output encoding, see the [Output Encoding](/application-security-handbook/web-application/output-encoding.md) page.
* Implement HTML sanitization, see [DOMPurify](https://github.com/cure53/DOMPurify).
* Comply with requirements from the [Cookie Security](/application-security-handbook/web-application/cookie-security.md) page.
* Enforce strict Content Security Policy, see the [Content Security Policy (CSP)](/application-security-handbook/web-application/content-security-policy-csp.md) page.

<div align="left"><img src="/files/P0T6i9QsRZT0gGQKpPIC" alt=""></div>

* Use stable versions of modern JavaScript frameworks such as Angular, Vue or React and their protection mechanisms.

## References

* [OWASP Cheat Sheet Series: Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)