# What is Cross-Site Scripting (XSS)?

> Cross-site scripting (XSS) is a web application weakness that allows attacker-controlled content to be interpreted as executable code in another user’s browser within a trusted application context.

- Canonical URL: https://yellowcube.eu/glossary/cross-site-scripting/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The content may be returned immediately, stored and served later, or introduced through unsafe client-side document manipulation. Execution can act with the page’s origin and accessible user context, affecting displayed content, data, or actions.

Prevention depends on keeping untrusted data out of executable contexts. Applications should use safe framework behavior and sinks, apply context-specific output encoding, and sanitize content when users are intentionally allowed to supply limited markup.

### Key points

- **Common forms:** Reflected XSS returns unsafe input in a response, stored XSS serves previously saved content, and Document Object Model-based XSS arises from unsafe client-side data flow and execution.
- **Primary prevention:** Prefer templating and browser interfaces that treat values as text, encode output for its exact context, validate dangerous URLs, avoid unnecessary dynamic code execution, and use maintained sanitizers for permitted markup.
- **Containment:** Apply a well-designed Content Security Policy, protect sensitive cookies, minimize exposed browser data, and constrain third-party scripts as defense in depth rather than substitutes for safe data handling.
- **Important limitation:** Input validation, a web application firewall, or Content Security Policy alone cannot cover every execution context or client-side path. A browser’s same-origin policy does not prevent code that the trusted page itself has introduced.

### Related terms

[Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Cross-site request forgery (CSRF)](<https://yellowcube.eu/glossary/cross-site-request-forgery/>) · [Clickjacking](<https://yellowcube.eu/glossary/clickjacking/>) · [Web application firewall (WAF)](<https://yellowcube.eu/glossary/web-application-firewall/>) · [Browser security](<https://yellowcube.eu/glossary/browser-security/>)

### Sources

[OWASP Cross-Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) · [MITRE CWE-79: Cross-site Scripting](https://cwe.mitre.org/data/definitions/79.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.