LESSON 2.1
Cross-site scripting (XSS)
Learn key techniques and workflows in Practical Web Security.
18m
intermediate
11,213 students
Overview
XSS is attacker-controlled content executing as script in your page. Contextual output encoding is the fix; blocklists are not.
In this lesson you will:
- Tell stored, reflected, and DOM-based XSS apart
- Encode output for the context it lands in
- Constrain script sources with a content security policy
Pro Tip
Use caching and revalidation wisely to ensure your app stays fast and data remains fresh without unnecessary requests.