Lesson 2.1
Cross-site scripting (XSS)
XSS is attacker-controlled content executing as script in your page. Contextual output encoding is the fix; blocklists are not.
18mIntermediate11,213 students
Sign in to watch this lesson
Browsing is free. Create an account to play videos and track your progress.
Overview
XSS is attacker-controlled content executing as script in your page. Contextual output encoding is the fix; blocklists are not.
What this lesson covers
- Tell stored, reflected, and DOM-based XSS apart
- Encode output for the context it lands in
- Constrain script sources with a content security policy
This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will:
- Tell stored, reflected, and DOM-based XSS apart
- Encode output for the context it lands in
- Constrain script sources with a content security policy