Injection attacks that fire inside the user's browser instead of the server.
XSS: cross-site scripting
XSS means an attacker manages to run their JavaScript in a victim's browser, in the context of your site.
Why that's dangerous: JavaScript in the page context can:
- read everything on the page, including sensitive data
- make API requests impersonating the logged-in user (it has the cookies)
- redirect the user to a phishing page and steal credentials
- rewrite the page to trick the user into thinking it's a different site
How it happens: stored XSS
- Attacker content
An attacker posts content containing a script, illustrated by stealCookies().
- Store
Storing the text does not make it trusted.
- Render
Unsafe HTML insertion can turn the stored text into executable DOM content.
- Defend
Use context-appropriate escaping or deliberate sanitization for allowed HTML. HttpOnly restricts cookie reads but does not eliminate XSS.
Stored XSS occurs when attacker-controlled content is interpreted as executable browser code.
How to read this model
A content archive feeding a browser rendering press. The object is a teaching analogy. Inspecting a part highlights its role; it does not execute or simulate the software. Cabinet trays are records, workpieces are data, and latches are checks. Unless an explanation states a quantity, compartments and sample workpieces do not denote data counts. Part dimensions are not a quantitative scale.
The comment box renders markdown → HTML, and that HTML is injected straight into the DOM. If the server doesn't sanitize, the <script> tag travels with it and executes for every reader.
React makes this loud: dangerouslySetInnerHTML is named that way on purpose. When you set raw HTML, you're on your own.
Three flavors
| Type | Where the script comes from |
|---|---|
| Stored | persisted (a comment, a profile): fires for every viewer |
| Reflected | echoed from the URL/query params in the response |
| DOM-based | injected client-side via innerHTML |
Prevention
- Sanitize user content before you store or render it: strip script tags, escape output. Use a proper sanitizer library.
- CSP: Content Security Policy. An HTTP header where your server tells the browser exactly which scripts are allowed to run. A strict CSP (
no inline scripts, allow-list your domains) blocks injected scripts even if one slips through.
CSRF: cross-site request forgery
CSRF abuses the fact that browsers automatically attach cookies to a site, even when the request originates from a different site.
- Session
The user is signed into bank.com and has its authentication cookie.
- Attacker site
evil.com attempts to cause a request to the bank, for example with a submitted form.
- Credential attachment
When cookie policy permits, the browser attaches credentials automatically.
- Defend
Enforce appropriate CSRF controls, such as validated tokens and origin checks, with deliberate SameSite cookie policy.
The browser’s attached credentials do not establish that the user intended the action.
How to read this model
A browser dispatch mechanism carrying an attached session key. The object is a teaching analogy. Inspecting a part highlights its role; it does not execute or simulate the software. Cabinet trays are records, workpieces are data, and latches are checks. Unless an explanation states a quantity, compartments and sample workpieces do not denote data counts. Part dimensions are not a quantitative scale.
Terms: GLOSSARY · Related: communication · Next: misconfiguration · Up: security mindset