The content may be returned immediately, stored and served later, or introduced through unsafe client-side document manipulation. Execution can act with the page’s origin and accessible user context, affecting displayed content, data, or actions.
Prevention depends on keeping untrusted data out of executable contexts. Applications should use safe framework behavior and sinks, apply context-specific output encoding, and sanitize content when users are intentionally allowed to supply limited markup.
Key points
Common formsReflected XSS returns unsafe input in a response, stored XSS serves previously saved content, and Document Object Model-based XSS arises from unsafe client-side data flow and execution.
Primary preventionPrefer templating and browser interfaces that treat values as text, encode output for its exact context, validate dangerous URLs, avoid unnecessary dynamic code execution, and use maintained sanitizers for permitted markup.
ContainmentApply a well-designed Content Security Policy, protect sensitive cookies, minimize exposed browser data, and constrain third-party scripts as defense in depth rather than substitutes for safe data handling.
Important limitationInput validation, a web application firewall, or Content Security Policy alone cannot cover every execution context or client-side path. A browser’s same-origin policy does not prevent code that the trusted page itself has introduced.