Glossary term
What is XSS (Cross-Site Scripting)?
XSS stands for Cross-Site Scripting.
In System Design
Attacker's script runs in other users' browsers. Example: A malicious comment that steals tokens.
Learn it properly · System DesignLesson 52: OWASP Top 10 for Backend DevelopersMost breaches don't need a genius hacker — just a missing ownership check, a string-glued SQL query or a default password. The OWASP Top 10 explained for backend developers, with the attack, the fix and a real incident for each, plus the API-specific risks.In The Browser Contract
An attacker makes their JavaScript run on your site. That code can read stored data and act as the user.
Learn it properly · The Browser ContractLesson 3: Where Do Tokens Live? XSS, CSRF and the Storage Trade-offlocalStorage lets XSS steal tokens. Cookies let CSRF attacks use you. Safe patterns: HttpOnly cookies with SameSite or CSRF tokens, access tokens kept in memory, and a backend-for-frontend.In Security for Developers
An attacker's JavaScript runs in another user's browser on your site, because user text was put into the page without encoding.
Learn it properly · Security for DevelopersLesson 2: XSS, CSRF, Clickjacking and Security HeadersHow a script gets into your page and how to stop it with output encoding and CSP, how CSRF uses your cookies, SameSite and CSRF tokens, frame-ancestors, and the headers worth setting.