What is Cross-Site Scripting (XSS) and how do you prevent it?

Summary

XSS lets attackers inject script into pages viewed by other users, stealing sessions or acting as them. Prevent it with context-aware output encoding (auto-escaping templates), sanitizing any HTML you must render (DOMPurify, nh3), avoiding dangerous sinks (innerHTML, dangerouslySetInnerHTML, eval), and a strict Content-Security-Policy.

Longer Answer

Types: stored (saved in DB), reflected (from the request), and DOM-based (client-side JS writes untrusted data into the DOM). Frameworks like React and Jinja escape by default, so XSS usually appears where developers bypass escaping or inject into URLs (javascript:), attributes, or script/style contexts. HttpOnly cookies limit session theft but don't stop XSS actions.

Key Points

• Stored, reflected, DOM-based
• Escape output per context
• Sanitize rich HTML
• Avoid dangerous sinks
• CSP as defense in depth