XSS from the backend's view
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
know what the backend does about cross-site scripting.
Planned topics
- XSS: an attacker's script runs in another user's browser.
- Stored XSS: the payload is saved (for example in a product review) and shown to others. Reflected XSS: it is echoed back from the request, such as in a link.
- A JSON API is mostly safe if it returns the right
Content-Type: application/jsonand never HTML built from input. - If you produce HTML or emails, encode output for its context.
- Add headers such as
X-Content-Type-Options: nosniffand a Content-Security-Policy (more in JNR-042).
Draft outline details
Demonstration
review text <script>alert(1)</script> stored as text and shown encoded as <script>....
Check your understanding
Which is saved and shown to many users: stored or reflected XSS?
Show answer
Stored.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.