Cross-Site Scripting (XSS)

Cross-site scripting (XSS) occurs when an attacker injects malicious scripts into content served to other users.

XSS has been a well-understood defect class since the late 1990s. Modern web frameworks include built-in protections — yet XSS continues to appear at scale.

The toolkit is well established: contextual output encoding, framework-enforced escaping, HTML sanitization, URL validation, safe DOM APIs, and content security policy. Each does different work. Which ones your product needs is a design question.

Its persistence signals that security is treated as optional rather than default.

Discussion prompts

• How does your team prevent XSS — through developer discipline, framework defaults, or automated scanning?
• Have you ever shipped an XSS defect? What was the root cause — and did you eliminate the class?
• What would it take to make XSS structurally impossible in your web applications?