XSS من منظور الواجهة الخلفية

في هذا الدرس

know what the backend does about cross-site scripting.

الموضوعات المخطط لها

• XSS: an attacker's script runs in another user's browser.
• Stored XSS: the payload is saved (for example in a product review) and shown to others. Reflected XSS: it is echoed back from the request, such as in a link.
• A JSON API is mostly safe if it returns the right Content-Type: application/json and never HTML built from input.
• If you produce HTML or emails, encode output for its context.
• Add headers such as X-Content-Type-Options: nosniff and a Content-Security-Policy (more in JNR-042).