What is Cross-Site Scripting (XSS)?
An injection flaw where attacker-supplied scripts execute in a victim’s browser, stealing sessions or defacing pages. Output-encoding, framework auto-escaping, and strong CSP turn most payloads inert.
Example
A project comment feed renders user text with Svelte {@html} and stored scripts run for every visitor. Switching to plain text interpolation keeps markup inert while links still render through an allowlisted markdown step.
What people get wrong
Filtering only known-bad strings such as script tags. Attackers encode, nest, or split payloads; escaping output and enforcing CSP defend structurally instead of chasing signatures.
Frequently asked questions
Does a CSP make XSS impossible?
No. CSP sharply limits blast radius, but gaps such as unsafe-inline or a trusted-but-compromised script source still allow execution. Fix the injection and keep the policy tight.
Related terms
Content Security Policy
An HTTP response header that whitelists exactly which origins may supply scripts, styles, and frames. A tight policy neuters injected payloads even after an XSS bug ships.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.
Clickjacking & X-Frame-Options
A UI-redress attack that layers an invisible frame over a legitimate page to hijack clicks. The frame-ancestors CSP directive or X-Frame-Options DENY keeps sensitive pages unframeable.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
HTTP Strict Transport Security (HSTS)
A response header that obliges browsers to use HTTPS only for a domain, blocking protocol-downgrade attacks. BYOB’s Traefik edge already redirects port 80 to 443, and HSTS pins that behavior client-side.