Cross-site scripting (XSS)

XSS is attacker-controlled content executing as script in your page. Contextual output encoding is the fix; blocklists are not.

What this lesson covers

• Tell stored, reflected, and DOM-based XSS apart
• Encode output for the context it lands in
• Constrain script sources with a content security policy

This lesson sits in Common Web Vulnerabilities, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.